src/plugins/nat/nat.c

   1 /*
   2  * snat.c - simple nat plugin
   3  *
   4  * Copyright (c) 2016 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ip/ip4.h>
  21 #include <vnet/plugin/plugin.h>
  22 #include <nat/nat.h>
  23 #include <nat/nat_ipfix_logging.h>
  24 #include <nat/nat_det.h>
  25 #include <nat/nat64.h>
  26 #include <vnet/fib/fib_table.h>
  27 #include <vnet/fib/ip4_fib.h>
  28
  29 #include <vpp/app/version.h>
  30
  31 snat_main_t snat_main;
  32
  33
  34 /* Hook up input features */
  35 VNET_FEATURE_INIT (ip4_snat_in2out, static) = {
  36   .arc_name = "ip4-unicast",
  37   .node_name = "nat44-in2out",
  38   .runs_before = VNET_FEATURES ("nat44-out2in"),
  39 };
  40 VNET_FEATURE_INIT (ip4_snat_out2in, static) = {
  41   .arc_name = "ip4-unicast",
  42   .node_name = "nat44-out2in",
  43   .runs_before = VNET_FEATURES ("ip4-lookup"),
  44 };
  45 VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = {
  46   .arc_name = "ip4-unicast",
  47   .node_name = "nat44-det-in2out",
  48   .runs_before = VNET_FEATURES ("nat44-det-out2in"),
  49 };
  50 VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = {
  51   .arc_name = "ip4-unicast",
  52   .node_name = "nat44-det-out2in",
  53   .runs_before = VNET_FEATURES ("ip4-lookup"),
  54 };
  55 VNET_FEATURE_INIT (ip4_snat_in2out_worker_handoff, static) = {
  56   .arc_name = "ip4-unicast",
  57   .node_name = "nat44-in2out-worker-handoff",
  58   .runs_before = VNET_FEATURES ("nat44-out2in-worker-handoff"),
  59 };
  60 VNET_FEATURE_INIT (ip4_snat_out2in_worker_handoff, static) = {
  61   .arc_name = "ip4-unicast",
  62   .node_name = "nat44-out2in-worker-handoff",
  63   .runs_before = VNET_FEATURES ("ip4-lookup"),
  64 };
  65 VNET_FEATURE_INIT (ip4_snat_in2out_fast, static) = {
  66   .arc_name = "ip4-unicast",
  67   .node_name = "nat44-in2out-fast",
  68   .runs_before = VNET_FEATURES ("nat44-out2in-fast"),
  69 };
  70 VNET_FEATURE_INIT (ip4_snat_out2in_fast, static) = {
  71   .arc_name = "ip4-unicast",
  72   .node_name = "nat44-out2in-fast",
  73   .runs_before = VNET_FEATURES ("ip4-lookup"),
  74 };
  75 VNET_FEATURE_INIT (ip4_snat_hairpin_dst, static) = {
  76   .arc_name = "ip4-unicast",
  77   .node_name = "nat44-hairpin-dst",
  78   .runs_before = VNET_FEATURES ("ip4-lookup"),
  79 };
  80
  81 /* Hook up output features */
  82 VNET_FEATURE_INIT (ip4_snat_in2out_output, static) = {
  83   .arc_name = "ip4-output",
  84   .node_name = "nat44-in2out-output",
  85   .runs_before = VNET_FEATURES ("interface-output"),
  86 };
  87 VNET_FEATURE_INIT (ip4_snat_in2out_output_worker_handoff, static) = {
  88   .arc_name = "ip4-output",
  89   .node_name = "nat44-in2out-output-worker-handoff",
  90   .runs_before = VNET_FEATURES ("interface-output"),
  91 };
  92 VNET_FEATURE_INIT (ip4_snat_hairpin_src, static) = {
  93   .arc_name = "ip4-output",
  94   .node_name = "nat44-hairpin-src",
  95   .runs_before = VNET_FEATURES ("interface-output"),
  96 };
  97
  98
  99 /* *INDENT-OFF* */
 100 VLIB_PLUGIN_REGISTER () = {
 101     .version = VPP_BUILD_VER,
 102     .description = "Network Address Translation",
 103 };
 104 /* *INDENT-ON* */
 105
 106 /**
 107  * @brief Add/del NAT address to FIB.
 108  *
 109  * Add the external NAT address to the FIB as receive entries. This ensures
 110  * that VPP will reply to ARP for this address and we don't need to enable
 111  * proxy ARP on the outside interface.
 112  *
 113  * @param addr IPv4 address.
 114  * @param plen address prefix length
 115  * @param sw_if_index Interface.
 116  * @param is_add If 0 delete, otherwise add.
 117  */
 118 void
 119 snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
 120                           int is_add)
 121 {
 122   fib_prefix_t prefix = {
 123     .fp_len = p_len,
 124     .fp_proto = FIB_PROTOCOL_IP4,
 125     .fp_addr = {
 126         .ip4.as_u32 = addr->as_u32,
 127     },
 128   };
 129   u32 fib_index = ip4_fib_table_get_index_for_sw_if_index(sw_if_index);
 130
 131   if (is_add)
 132     fib_table_entry_update_one_path(fib_index,
 133                                     &prefix,
 134                                     FIB_SOURCE_PLUGIN_HI,
 135                                     (FIB_ENTRY_FLAG_CONNECTED |
 136                                      FIB_ENTRY_FLAG_LOCAL |
 137                                      FIB_ENTRY_FLAG_EXCLUSIVE),
 138                                     DPO_PROTO_IP4,
 139                                     NULL,
 140                                     sw_if_index,
 141                                     ~0,
 142                                     1,
 143                                     NULL,
 144                                     FIB_ROUTE_PATH_FLAG_NONE);
 145   else
 146     fib_table_entry_delete(fib_index,
 147                            &prefix,
 148                            FIB_SOURCE_PLUGIN_HI);
 149 }
 150
 151 void snat_add_address (snat_main_t *sm, ip4_address_t *addr, u32 vrf_id)
 152 {
 153   snat_address_t * ap;
 154   snat_interface_t *i;
 155
 156   if (vrf_id != ~0)
 157     sm->vrf_mode = 1;
 158
 159   /* Check if address already exists */
 160   vec_foreach (ap, sm->addresses)
 161     {
 162       if (ap->addr.as_u32 == addr->as_u32)
 163         return;
 164     }
 165
 166   vec_add2 (sm->addresses, ap, 1);
 167   ap->addr = *addr;
 168   if (vrf_id != ~0)
 169     ap->fib_index =
 170       fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 171                                          FIB_SOURCE_PLUGIN_HI);
 172   else
 173     ap->fib_index = ~0;
 174 #define _(N, i, n, s) \
 175   clib_bitmap_alloc (ap->busy_##n##_port_bitmap, 65535);
 176   foreach_snat_protocol
 177 #undef _
 178
 179   /* Add external address to FIB */
 180   pool_foreach (i, sm->interfaces,
 181   ({
 182     if (i->is_inside)
 183       continue;
 184
 185     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 186     break;
 187   }));
 188   pool_foreach (i, sm->output_feature_interfaces,
 189   ({
 190     if (i->is_inside)
 191       continue;
 192
 193     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 194     break;
 195   }));
 196 }
 197
 198 static int is_snat_address_used_in_static_mapping (snat_main_t *sm,
 199                                                    ip4_address_t addr)
 200 {
 201   snat_static_mapping_t *m;
 202   pool_foreach (m, sm->static_mappings,
 203   ({
 204       if (m->external_addr.as_u32 == addr.as_u32)
 205         return 1;
 206   }));
 207
 208   return 0;
 209 }
 210
 211 void increment_v4_address (ip4_address_t * a)
 212 {
 213   u32 v;
 214
 215   v = clib_net_to_host_u32(a->as_u32) + 1;
 216   a->as_u32 = clib_host_to_net_u32(v);
 217 }
 218
 219 static void
 220 snat_add_static_mapping_when_resolved (snat_main_t * sm,
 221                                        ip4_address_t l_addr,
 222                                        u16 l_port,
 223                                        u32 sw_if_index,
 224                                        u16 e_port,
 225                                        u32 vrf_id,
 226                                        snat_protocol_t proto,
 227                                        int addr_only,
 228                                        int is_add)
 229 {
 230   snat_static_map_resolve_t *rp;
 231
 232   vec_add2 (sm->to_resolve, rp, 1);
 233   rp->l_addr.as_u32 = l_addr.as_u32;
 234   rp->l_port = l_port;
 235   rp->sw_if_index = sw_if_index;
 236   rp->e_port = e_port;
 237   rp->vrf_id = vrf_id;
 238   rp->proto = proto;
 239   rp->addr_only = addr_only;
 240   rp->is_add = is_add;
 241 }
 242
 243 /**
 244  * @brief Add static mapping.
 245  *
 246  * Create static mapping between local addr+port and external addr+port.
 247  *
 248  * @param l_addr Local IPv4 address.
 249  * @param e_addr External IPv4 address.
 250  * @param l_port Local port number.
 251  * @param e_port External port number.
 252  * @param vrf_id VRF ID.
 253  * @param addr_only If 0 address port and pair mapping, otherwise address only.
 254  * @param sw_if_index External port instead of specific IP address.
 255  * @param is_add If 0 delete static mapping, otherwise add.
 256  *
 257  * @returns
 258  */
 259 int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
 260                             u16 l_port, u16 e_port, u32 vrf_id, int addr_only,
 261                             u32 sw_if_index, snat_protocol_t proto, int is_add)
 262 {
 263   snat_main_t * sm = &snat_main;
 264   snat_static_mapping_t *m;
 265   snat_session_key_t m_key;
 266   clib_bihash_kv_8_8_t kv, value;
 267   snat_address_t *a = 0;
 268   u32 fib_index = ~0;
 269   uword * p;
 270   snat_interface_t *interface;
 271   int i;
 272
 273   /* If the external address is a specific interface address */
 274   if (sw_if_index != ~0)
 275     {
 276       ip4_address_t * first_int_addr;
 277
 278       /* Might be already set... */
 279       first_int_addr = ip4_interface_first_address
 280         (sm->ip4_main, sw_if_index, 0 /* just want the address*/);
 281
 282       /* DHCP resolution required? */
 283       if (first_int_addr == 0)
 284         {
 285           snat_add_static_mapping_when_resolved
 286             (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
 287              addr_only,  is_add);
 288           return 0;
 289         }
 290         else
 291           e_addr.as_u32 = first_int_addr->as_u32;
 292     }
 293
 294   m_key.addr = e_addr;
 295   m_key.port = addr_only ? 0 : e_port;
 296   m_key.protocol = addr_only ? 0 : proto;
 297   m_key.fib_index = sm->outside_fib_index;
 298   kv.key = m_key.as_u64;
 299   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 300     m = 0;
 301   else
 302     m = pool_elt_at_index (sm->static_mappings, value.value);
 303
 304   if (is_add)
 305     {
 306       if (m)
 307         return VNET_API_ERROR_VALUE_EXIST;
 308
 309       /* Convert VRF id to FIB index */
 310       if (vrf_id != ~0)
 311         {
 312           p = hash_get (sm->ip4_main->fib_index_by_table_id, vrf_id);
 313           if (!p)
 314             return VNET_API_ERROR_NO_SUCH_FIB;
 315           fib_index = p[0];
 316         }
 317       /* If not specified use inside VRF id from SNAT plugin startup config */
 318       else
 319         {
 320           fib_index = sm->inside_fib_index;
 321           vrf_id = sm->inside_vrf_id;
 322         }
 323
 324       /* Find external address in allocated addresses and reserve port for
 325          address and port pair mapping when dynamic translations enabled */
 326       if (!addr_only && !(sm->static_mapping_only))
 327         {
 328           for (i = 0; i < vec_len (sm->addresses); i++)
 329             {
 330               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 331                 {
 332                   a = sm->addresses + i;
 333                   /* External port must be unused */
 334                   switch (proto)
 335                     {
 336 #define _(N, j, n, s) \
 337                     case SNAT_PROTOCOL_##N: \
 338                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 339                         return VNET_API_ERROR_INVALID_VALUE; \
 340                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 341                       if (e_port > 1024) \
 342                         a->busy_##n##_ports++; \
 343                       break;
 344                       foreach_snat_protocol
 345 #undef _
 346                     default:
 347                       clib_warning("unknown_protocol");
 348                       return VNET_API_ERROR_INVALID_VALUE_2;
 349                     }
 350                   break;
 351                 }
 352             }
 353           /* External address must be allocated */
 354           if (!a)
 355             return VNET_API_ERROR_NO_SUCH_ENTRY;
 356         }
 357
 358       pool_get (sm->static_mappings, m);
 359       memset (m, 0, sizeof (*m));
 360       m->local_addr = l_addr;
 361       m->external_addr = e_addr;
 362       m->addr_only = addr_only;
 363       m->vrf_id = vrf_id;
 364       m->fib_index = fib_index;
 365       if (!addr_only)
 366         {
 367           m->local_port = l_port;
 368           m->external_port = e_port;
 369           m->proto = proto;
 370         }
 371
 372       m_key.addr = m->local_addr;
 373       m_key.port = m->local_port;
 374       m_key.protocol = m->proto;
 375       m_key.fib_index = m->fib_index;
 376       kv.key = m_key.as_u64;
 377       kv.value = m - sm->static_mappings;
 378       clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
 379
 380       m_key.addr = m->external_addr;
 381       m_key.port = m->external_port;
 382       m_key.fib_index = sm->outside_fib_index;
 383       kv.key = m_key.as_u64;
 384       kv.value = m - sm->static_mappings;
 385       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1);
 386
 387       /* Assign worker */
 388       if (sm->workers)
 389         {
 390           snat_user_key_t w_key0;
 391           snat_worker_key_t w_key1;
 392
 393           w_key0.addr = m->local_addr;
 394           w_key0.fib_index = m->fib_index;
 395           kv.key = w_key0.as_u64;
 396
 397           if (clib_bihash_search_8_8 (&sm->worker_by_in, &kv, &value))
 398             {
 399               kv.value = sm->first_worker_index +
 400                 sm->workers[sm->next_worker++ % vec_len (sm->workers)];
 401
 402               clib_bihash_add_del_8_8 (&sm->worker_by_in, &kv, 1);
 403             }
 404           else
 405             {
 406               kv.value = value.value;
 407             }
 408
 409           w_key1.addr = m->external_addr;
 410           w_key1.port = clib_host_to_net_u16 (m->external_port);
 411           w_key1.fib_index = sm->outside_fib_index;
 412           kv.key = w_key1.as_u64;
 413           clib_bihash_add_del_8_8 (&sm->worker_by_out, &kv, 1);
 414         }
 415     }
 416   else
 417     {
 418       if (!m)
 419         return VNET_API_ERROR_NO_SUCH_ENTRY;
 420
 421       /* Free external address port */
 422       if (!addr_only && !(sm->static_mapping_only))
 423         {
 424           for (i = 0; i < vec_len (sm->addresses); i++)
 425             {
 426               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 427                 {
 428                   a = sm->addresses + i;
 429                   switch (proto)
 430                     {
 431 #define _(N, j, n, s) \
 432                     case SNAT_PROTOCOL_##N: \
 433                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
 434                       if (e_port > 1024) \
 435                         a->busy_##n##_ports--; \
 436                       break;
 437                       foreach_snat_protocol
 438 #undef _
 439                     default:
 440                       clib_warning("unknown_protocol");
 441                       return VNET_API_ERROR_INVALID_VALUE_2;
 442                     }
 443                   break;
 444                 }
 445             }
 446         }
 447
 448       m_key.addr = m->local_addr;
 449       m_key.port = m->local_port;
 450       m_key.protocol = m->proto;
 451       m_key.fib_index = m->fib_index;
 452       kv.key = m_key.as_u64;
 453       clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0);
 454
 455       m_key.addr = m->external_addr;
 456       m_key.port = m->external_port;
 457       m_key.fib_index = sm->outside_fib_index;
 458       kv.key = m_key.as_u64;
 459       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0);
 460
 461       /* Delete session(s) for static mapping if exist */
 462       if (!(sm->static_mapping_only) ||
 463           (sm->static_mapping_only && sm->static_mapping_connection_tracking))
 464         {
 465           snat_user_key_t u_key;
 466           snat_user_t *u;
 467           dlist_elt_t * head, * elt;
 468           u32 elt_index, head_index, del_elt_index;
 469           u32 ses_index;
 470           u64 user_index;
 471           snat_session_t * s;
 472           snat_main_per_thread_data_t *tsm;
 473
 474           u_key.addr = m->local_addr;
 475           u_key.fib_index = m->fib_index;
 476           kv.key = u_key.as_u64;
 477           if (!clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
 478             {
 479               user_index = value.value;
 480               if (!clib_bihash_search_8_8 (&sm->worker_by_in, &kv, &value))
 481                 tsm = vec_elt_at_index (sm->per_thread_data, value.value);
 482               else
 483                 tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
 484               u = pool_elt_at_index (tsm->users, user_index);
 485               if (u->nstaticsessions)
 486                 {
 487                   head_index = u->sessions_per_user_list_head_index;
 488                   head = pool_elt_at_index (tsm->list_pool, head_index);
 489                   elt_index = head->next;
 490                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
 491                   ses_index = elt->value;
 492                   while (ses_index != ~0)
 493                     {
 494                       s =  pool_elt_at_index (tsm->sessions, ses_index);
 495                       del_elt_index = elt_index;
 496                       elt_index = elt->next;
 497                       elt = pool_elt_at_index (tsm->list_pool, elt_index);
 498                       ses_index = elt->value;
 499
 500                       if (!addr_only)
 501                         {
 502                           if ((s->out2in.addr.as_u32 != e_addr.as_u32) &&
 503                               (clib_net_to_host_u16 (s->out2in.port) != e_port))
 504                             continue;
 505                         }
 506
 507                       if (snat_is_unk_proto_session (s))
 508                         {
 509                           clib_bihash_kv_16_8_t up_kv;
 510                           nat_ed_ses_key_t up_key;
 511                           up_key.l_addr = s->in2out.addr;
 512                           up_key.r_addr = s->ext_host_addr;
 513                           up_key.fib_index = s->in2out.fib_index;
 514                           up_key.proto = s->in2out.port;
 515                           up_key.rsvd = 0;
 516                           up_key.l_port = 0;
 517                           up_kv.key[0] = up_key.as_u64[0];
 518                           up_kv.key[1] = up_key.as_u64[1];
 519                           if (clib_bihash_add_del_16_8 (&sm->in2out_ed,
 520                                                         &up_kv, 0))
 521                             clib_warning ("in2out key del failed");
 522
 523                           up_key.l_addr = s->out2in.addr;
 524                           up_key.fib_index = s->out2in.fib_index;
 525                           up_kv.key[0] = up_key.as_u64[0];
 526                           up_kv.key[1] = up_key.as_u64[1];
 527                           if (clib_bihash_add_del_16_8 (&sm->out2in_ed,
 528                                                         &up_kv, 0))
 529                             clib_warning ("out2in key del failed");
 530
 531                           goto delete;
 532                         }
 533                       /* log NAT event */
 534                       snat_ipfix_logging_nat44_ses_delete(s->in2out.addr.as_u32,
 535                                                           s->out2in.addr.as_u32,
 536                                                           s->in2out.protocol,
 537                                                           s->in2out.port,
 538                                                           s->out2in.port,
 539                                                           s->in2out.fib_index);
 540
 541                       value.key = s->in2out.as_u64;
 542                       if (clib_bihash_add_del_8_8 (&sm->in2out, &value, 0))
 543                         clib_warning ("in2out key del failed");
 544                       value.key = s->out2in.as_u64;
 545                       if (clib_bihash_add_del_8_8 (&sm->out2in, &value, 0))
 546                         clib_warning ("out2in key del failed");
 547 delete:
 548                       pool_put (tsm->sessions, s);
 549
 550                       clib_dlist_remove (tsm->list_pool, del_elt_index);
 551                       pool_put_index (tsm->list_pool, del_elt_index);
 552                       u->nstaticsessions--;
 553
 554                       if (!addr_only)
 555                         break;
 556                     }
 557                   if (addr_only)
 558                     {
 559                       pool_put (tsm->users, u);
 560                       clib_bihash_add_del_8_8 (&sm->user_hash, &kv, 0);
 561                     }
 562                 }
 563             }
 564         }
 565
 566       /* Delete static mapping from pool */
 567       pool_put (sm->static_mappings, m);
 568     }
 569
 570   if (!addr_only)
 571     return 0;
 572
 573   /* Add/delete external address to FIB */
 574   pool_foreach (interface, sm->interfaces,
 575   ({
 576     if (interface->is_inside)
 577       continue;
 578
 579     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
 580     break;
 581   }));
 582   pool_foreach (interface, sm->output_feature_interfaces,
 583   ({
 584     if (interface->is_inside)
 585       continue;
 586
 587     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
 588     break;
 589   }));
 590
 591   return 0;
 592 }
 593
 594 int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
 595                                      snat_protocol_t proto, u32 vrf_id,
 596                                      nat44_lb_addr_port_t *locals, u8 is_add)
 597 {
 598   snat_main_t * sm = &snat_main;
 599   snat_static_mapping_t *m;
 600   snat_session_key_t m_key;
 601   clib_bihash_kv_8_8_t kv, value;
 602   u32 fib_index;
 603   snat_address_t *a = 0;
 604   int i;
 605   nat44_lb_addr_port_t *local;
 606   snat_user_key_t w_key0;
 607   snat_worker_key_t w_key1;
 608   u32 worker_index = 0;
 609
 610   m_key.addr = e_addr;
 611   m_key.port = e_port;
 612   m_key.protocol = proto;
 613   m_key.fib_index = sm->outside_fib_index;
 614   kv.key = m_key.as_u64;
 615   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 616     m = 0;
 617   else
 618     m = pool_elt_at_index (sm->static_mappings, value.value);
 619
 620   if (is_add)
 621     {
 622       if (m)
 623         return VNET_API_ERROR_VALUE_EXIST;
 624
 625       if (vec_len (locals) < 2)
 626         return VNET_API_ERROR_INVALID_VALUE;
 627
 628       fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
 629                                                      vrf_id,
 630                                                      FIB_SOURCE_PLUGIN_HI);
 631
 632       /* Find external address in allocated addresses and reserve port for
 633          address and port pair mapping when dynamic translations enabled */
 634       if (!sm->static_mapping_only)
 635         {
 636           for (i = 0; i < vec_len (sm->addresses); i++)
 637             {
 638               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 639                 {
 640                   a = sm->addresses + i;
 641                   /* External port must be unused */
 642                   switch (proto)
 643                     {
 644 #define _(N, j, n, s) \
 645                     case SNAT_PROTOCOL_##N: \
 646                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 647                         return VNET_API_ERROR_INVALID_VALUE; \
 648                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 649                       if (e_port > 1024) \
 650                         a->busy_##n##_ports++; \
 651                       break;
 652                       foreach_snat_protocol
 653 #undef _
 654                     default:
 655                       clib_warning("unknown_protocol");
 656                       return VNET_API_ERROR_INVALID_VALUE_2;
 657                     }
 658                   break;
 659                 }
 660             }
 661           /* External address must be allocated */
 662           if (!a)
 663             return VNET_API_ERROR_NO_SUCH_ENTRY;
 664         }
 665
 666       pool_get (sm->static_mappings, m);
 667       memset (m, 0, sizeof (*m));
 668       m->external_addr = e_addr;
 669       m->addr_only = 0;
 670       m->vrf_id = vrf_id;
 671       m->fib_index = fib_index;
 672       m->external_port = e_port;
 673       m->proto = proto;
 674
 675       m_key.addr = m->external_addr;
 676       m_key.port = m->external_port;
 677       m_key.protocol = m->proto;
 678       m_key.fib_index = sm->outside_fib_index;
 679       kv.key = m_key.as_u64;
 680       kv.value = m - sm->static_mappings;
 681       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1))
 682         {
 683           clib_warning ("static_mapping_by_external key add failed");
 684           return VNET_API_ERROR_UNSPECIFIED;
 685         }
 686       m_key.port = clib_host_to_net_u16 (m->external_port);
 687       kv.key = m_key.as_u64;
 688       kv.value = ~0ULL;
 689       if (clib_bihash_add_del_8_8(&sm->out2in, &kv, 1))
 690         {
 691           clib_warning ("static_mapping_by_local key add failed");
 692           return VNET_API_ERROR_UNSPECIFIED;
 693         }
 694
 695       m_key.fib_index = m->fib_index;
 696
 697       /* Assign worker */
 698       if (sm->workers)
 699         {
 700           w_key0.addr = locals[0].addr;
 701           w_key0.fib_index = fib_index;
 702           kv.key = w_key0.as_u64;
 703
 704           if (clib_bihash_search_8_8 (&sm->worker_by_in, &kv, &value))
 705             worker_index = sm->first_worker_index +
 706               sm->workers[sm->next_worker++ % vec_len (sm->workers)];
 707           else
 708             worker_index = value.value;
 709
 710           w_key1.addr = m->external_addr;
 711           w_key1.port = clib_host_to_net_u16 (m->external_port);
 712           w_key1.fib_index = sm->outside_fib_index;
 713           kv.key = w_key1.as_u64;
 714           kv.value = worker_index;
 715           if (clib_bihash_add_del_8_8 (&sm->worker_by_out, &kv, 1))
 716             {
 717               clib_warning ("worker-by-out add key failed");
 718               return VNET_API_ERROR_UNSPECIFIED;
 719             }
 720         }
 721
 722       for (i = 0; i < vec_len (locals); i++)
 723         {
 724           m_key.addr = locals[i].addr;
 725           m_key.port = locals[i].port;
 726           kv.key = m_key.as_u64;
 727           kv.value = m - sm->static_mappings;
 728           clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
 729           locals[i].prefix = (i == 0) ? locals[i].probability :\
 730             (locals[i - 1].prefix + locals[i].probability);
 731           vec_add1 (m->locals, locals[i]);
 732           m_key.port = clib_host_to_net_u16 (locals[i].port);
 733           kv.key = m_key.as_u64;
 734           kv.value = ~0ULL;
 735           if (clib_bihash_add_del_8_8(&sm->in2out, &kv, 1))
 736             {
 737               clib_warning ("in2out key add failed");
 738               return VNET_API_ERROR_UNSPECIFIED;
 739             }
 740           /* Assign worker */
 741           if (sm->workers)
 742             {
 743               w_key0.addr = locals[i].addr;
 744               w_key0.fib_index = fib_index;
 745               kv.key = w_key0.as_u64;
 746               kv.value = worker_index;
 747               if (clib_bihash_add_del_8_8 (&sm->worker_by_in, &kv, 1))
 748                 {
 749                   clib_warning ("worker-by-in key add failed");
 750                   return VNET_API_ERROR_UNSPECIFIED;
 751                 }
 752             }
 753         }
 754     }
 755   else
 756     {
 757       if (!m)
 758         return VNET_API_ERROR_NO_SUCH_ENTRY;
 759
 760       fib_table_unlock (m->fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_HI);
 761
 762       /* Free external address port */
 763       if (!sm->static_mapping_only)
 764         {
 765           for (i = 0; i < vec_len (sm->addresses); i++)
 766             {
 767               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 768                 {
 769                   a = sm->addresses + i;
 770                   switch (proto)
 771                     {
 772 #define _(N, j, n, s) \
 773                     case SNAT_PROTOCOL_##N: \
 774                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
 775                       if (e_port > 1024) \
 776                         a->busy_##n##_ports--; \
 777                       break;
 778                       foreach_snat_protocol
 779 #undef _
 780                     default:
 781                       clib_warning("unknown_protocol");
 782                       return VNET_API_ERROR_INVALID_VALUE_2;
 783                     }
 784                   break;
 785                 }
 786             }
 787         }
 788
 789       m_key.addr = m->external_addr;
 790       m_key.port = m->external_port;
 791       m_key.protocol = m->proto;
 792       m_key.fib_index = sm->outside_fib_index;
 793       kv.key = m_key.as_u64;
 794       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0))
 795         {
 796           clib_warning ("static_mapping_by_external key del failed");
 797           return VNET_API_ERROR_UNSPECIFIED;
 798         }
 799       m_key.port = clib_host_to_net_u16 (m->external_port);
 800       kv.key = m_key.as_u64;
 801       if (clib_bihash_add_del_8_8(&sm->out2in, &kv, 0))
 802         {
 803           clib_warning ("outi2in key del failed");
 804           return VNET_API_ERROR_UNSPECIFIED;
 805         }
 806
 807       vec_foreach (local, m->locals)
 808         {
 809           m_key.addr = local->addr;
 810           m_key.port = local->port;
 811           m_key.fib_index = m->fib_index;
 812           kv.key = m_key.as_u64;
 813           if (clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0))
 814             {
 815               clib_warning ("static_mapping_by_local key del failed");
 816               return VNET_API_ERROR_UNSPECIFIED;
 817             }
 818           m_key.port = clib_host_to_net_u16 (local->port);
 819           kv.key = m_key.as_u64;
 820           if (clib_bihash_add_del_8_8(&sm->in2out, &kv, 0))
 821             {
 822               clib_warning ("in2out key del failed");
 823               return VNET_API_ERROR_UNSPECIFIED;
 824             }
 825         }
 826
 827       pool_put (sm->static_mappings, m);
 828     }
 829
 830   return 0;
 831 }
 832
 833 int snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm)
 834 {
 835   snat_address_t *a = 0;
 836   snat_session_t *ses;
 837   u32 *ses_to_be_removed = 0, *ses_index;
 838   clib_bihash_kv_8_8_t kv, value;
 839   snat_user_key_t user_key;
 840   snat_user_t *u;
 841   snat_main_per_thread_data_t *tsm;
 842   snat_static_mapping_t *m;
 843   snat_interface_t *interface;
 844   int i;
 845
 846   /* Find SNAT address */
 847   for (i=0; i < vec_len (sm->addresses); i++)
 848     {
 849       if (sm->addresses[i].addr.as_u32 == addr.as_u32)
 850         {
 851           a = sm->addresses + i;
 852           break;
 853         }
 854     }
 855   if (!a)
 856     return VNET_API_ERROR_NO_SUCH_ENTRY;
 857
 858   if (delete_sm)
 859     {
 860       pool_foreach (m, sm->static_mappings,
 861       ({
 862           if (m->external_addr.as_u32 == addr.as_u32)
 863             (void) snat_add_static_mapping (m->local_addr, m->external_addr,
 864                                             m->local_port, m->external_port,
 865                                             m->vrf_id, m->addr_only, ~0,
 866                                             m->proto, 0);
 867       }));
 868     }
 869   else
 870     {
 871       /* Check if address is used in some static mapping */
 872       if (is_snat_address_used_in_static_mapping(sm, addr))
 873         {
 874           clib_warning ("address used in static mapping");
 875           return VNET_API_ERROR_UNSPECIFIED;
 876         }
 877     }
 878
 879   if (a->fib_index != ~0)
 880     fib_table_unlock(a->fib_index, FIB_PROTOCOL_IP4,
 881                      FIB_SOURCE_PLUGIN_HI);
 882
 883   /* Delete sessions using address */
 884   if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
 885     {
 886       vec_foreach (tsm, sm->per_thread_data)
 887         {
 888           pool_foreach (ses, tsm->sessions, ({
 889             if (ses->out2in.addr.as_u32 == addr.as_u32)
 890               {
 891                 if (snat_is_unk_proto_session (ses))
 892                   {
 893                     clib_bihash_kv_16_8_t up_kv;
 894                     nat_ed_ses_key_t up_key;
 895                     up_key.l_addr = ses->in2out.addr;
 896                     up_key.r_addr = ses->ext_host_addr;
 897                     up_key.fib_index = ses->in2out.fib_index;
 898                     up_key.proto = ses->in2out.port;
 899                     up_key.rsvd = 0;
 900                     up_key.l_port = 0;
 901                     up_kv.key[0] = up_key.as_u64[0];
 902                     up_kv.key[1] = up_key.as_u64[1];
 903                     if (clib_bihash_add_del_16_8 (&sm->in2out_ed,
 904                                                   &up_kv, 0))
 905                       clib_warning ("in2out key del failed");
 906
 907                     up_key.l_addr = ses->out2in.addr;
 908                     up_key.fib_index = ses->out2in.fib_index;
 909                     up_kv.key[0] = up_key.as_u64[0];
 910                     up_kv.key[1] = up_key.as_u64[1];
 911                     if (clib_bihash_add_del_16_8 (&sm->out2in_ed,
 912                                                   &up_kv, 0))
 913                       clib_warning ("out2in key del failed");
 914                   }
 915                 else
 916                   {
 917                     /* log NAT event */
 918                     snat_ipfix_logging_nat44_ses_delete(ses->in2out.addr.as_u32,
 919                                                         ses->out2in.addr.as_u32,
 920                                                         ses->in2out.protocol,
 921                                                         ses->in2out.port,
 922                                                         ses->out2in.port,
 923                                                         ses->in2out.fib_index);
 924                     kv.key = ses->in2out.as_u64;
 925                     clib_bihash_add_del_8_8 (&sm->in2out, &kv, 0);
 926                     kv.key = ses->out2in.as_u64;
 927                     clib_bihash_add_del_8_8 (&sm->out2in, &kv, 0);
 928                   }
 929                 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
 930                 clib_dlist_remove (tsm->list_pool, ses->per_user_index);
 931                 user_key.addr = ses->in2out.addr;
 932                 user_key.fib_index = ses->in2out.fib_index;
 933                 kv.key = user_key.as_u64;
 934                 if (!clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
 935                   {
 936                     u = pool_elt_at_index (tsm->users, value.value);
 937                     u->nsessions--;
 938                   }
 939               }
 940           }));
 941
 942           vec_foreach (ses_index, ses_to_be_removed)
 943             pool_put_index (tsm->sessions, ses_index[0]);
 944
 945           vec_free (ses_to_be_removed);
 946        }
 947     }
 948
 949   vec_del1 (sm->addresses, i);
 950
 951   /* Delete external address from FIB */
 952   pool_foreach (interface, sm->interfaces,
 953   ({
 954     if (interface->is_inside)
 955       continue;
 956
 957     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
 958     break;
 959   }));
 960   pool_foreach (interface, sm->output_feature_interfaces,
 961   ({
 962     if (interface->is_inside)
 963       continue;
 964
 965     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
 966     break;
 967   }));
 968
 969   return 0;
 970 }
 971
 972 int snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
 973 {
 974   snat_main_t *sm = &snat_main;
 975   snat_interface_t *i;
 976   const char * feature_name;
 977   snat_address_t * ap;
 978   snat_static_mapping_t * m;
 979   snat_det_map_t * dm;
 980
 981   if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
 982     feature_name = is_inside ?  "nat44-in2out-fast" : "nat44-out2in-fast";
 983   else
 984     {
 985       if (sm->num_workers > 1 && !sm->deterministic)
 986         feature_name = is_inside ?  "nat44-in2out-worker-handoff" : "nat44-out2in-worker-handoff";
 987       else if (sm->deterministic)
 988         feature_name = is_inside ?  "nat44-det-in2out" : "nat44-det-out2in";
 989       else
 990         feature_name = is_inside ?  "nat44-in2out" : "nat44-out2in";
 991     }
 992
 993   vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index,
 994                                !is_del, 0, 0);
 995
 996   if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1)
 997     sm->fq_in2out_index = vlib_frame_queue_main_init (sm->in2out_node_index, 0);
 998
 999   if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1000     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
1001
1002   pool_foreach (i, sm->interfaces,
1003   ({
1004     if (i->sw_if_index == sw_if_index)
1005       {
1006         if (is_del)
1007           pool_put (sm->interfaces, i);
1008         else
1009           return VNET_API_ERROR_VALUE_EXIST;
1010
1011         goto fib;
1012       }
1013   }));
1014
1015   if (is_del)
1016     return VNET_API_ERROR_NO_SUCH_ENTRY;
1017
1018   pool_get (sm->interfaces, i);
1019   i->sw_if_index = sw_if_index;
1020   i->is_inside = is_inside;
1021
1022   /* Add/delete external addresses to FIB */
1023 fib:
1024   if (is_inside)
1025     return 0;
1026
1027   vec_foreach (ap, sm->addresses)
1028     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1029
1030   pool_foreach (m, sm->static_mappings,
1031   ({
1032     if (!(m->addr_only))
1033       continue;
1034
1035     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1036   }));
1037
1038   pool_foreach (dm, sm->det_maps,
1039   ({
1040     snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
1041   }));
1042
1043   return 0;
1044 }
1045
1046 int snat_interface_add_del_output_feature (u32 sw_if_index,
1047                                            u8 is_inside,
1048                                            int is_del)
1049 {
1050   snat_main_t *sm = &snat_main;
1051   snat_interface_t *i;
1052   snat_address_t * ap;
1053   snat_static_mapping_t * m;
1054
1055   if (sm->deterministic ||
1056       (sm->static_mapping_only && !(sm->static_mapping_connection_tracking)))
1057     return VNET_API_ERROR_UNSUPPORTED;
1058
1059   if (is_inside)
1060     {
1061       vnet_feature_enable_disable ("ip4-unicast", "nat44-hairpin-dst",
1062                                    sw_if_index, !is_del, 0, 0);
1063       vnet_feature_enable_disable ("ip4-output", "nat44-hairpin-src",
1064                                    sw_if_index, !is_del, 0, 0);
1065       goto fq;
1066     }
1067
1068   if (sm->num_workers > 1)
1069     {
1070       vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in-worker-handoff",
1071                                    sw_if_index, !is_del, 0, 0);
1072       vnet_feature_enable_disable ("ip4-output",
1073                                    "nat44-in2out-output-worker-handoff",
1074                                    sw_if_index, !is_del, 0, 0);
1075     }
1076   else
1077     {
1078       vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in", sw_if_index,
1079                                    !is_del, 0, 0);
1080       vnet_feature_enable_disable ("ip4-output", "nat44-in2out-output",
1081                                    sw_if_index, !is_del, 0, 0);
1082     }
1083
1084 fq:
1085   if (sm->fq_in2out_output_index == ~0 && sm->num_workers > 1)
1086     sm->fq_in2out_output_index =
1087       vlib_frame_queue_main_init (sm->in2out_output_node_index, 0);
1088
1089   if (sm->fq_out2in_index == ~0 && sm->num_workers > 1)
1090     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
1091
1092   pool_foreach (i, sm->output_feature_interfaces,
1093   ({
1094     if (i->sw_if_index == sw_if_index)
1095       {
1096         if (is_del)
1097           pool_put (sm->output_feature_interfaces, i);
1098         else
1099           return VNET_API_ERROR_VALUE_EXIST;
1100
1101         goto fib;
1102       }
1103   }));
1104
1105   if (is_del)
1106     return VNET_API_ERROR_NO_SUCH_ENTRY;
1107
1108   pool_get (sm->output_feature_interfaces, i);
1109   i->sw_if_index = sw_if_index;
1110   i->is_inside = is_inside;
1111
1112   /* Add/delete external addresses to FIB */
1113 fib:
1114   if (is_inside)
1115     return 0;
1116
1117   vec_foreach (ap, sm->addresses)
1118     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1119
1120   pool_foreach (m, sm->static_mappings,
1121   ({
1122     if (!(m->addr_only))
1123       continue;
1124
1125     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1126   }));
1127
1128   return 0;
1129 }
1130
1131 int snat_set_workers (uword * bitmap)
1132 {
1133   snat_main_t *sm = &snat_main;
1134   int i, j = 0;
1135
1136   if (sm->num_workers < 2)
1137     return VNET_API_ERROR_FEATURE_DISABLED;
1138
1139   if (clib_bitmap_last_set (bitmap) >= sm->num_workers)
1140     return VNET_API_ERROR_INVALID_WORKER;
1141
1142   vec_free (sm->workers);
1143   clib_bitmap_foreach (i, bitmap,
1144     ({
1145       vec_add1(sm->workers, i);
1146       sm->per_thread_data[i].snat_thread_index = j;
1147       j++;
1148     }));
1149
1150   sm->port_per_thread = (0xffff - 1024) / _vec_len (sm->workers);
1151   sm->num_snat_thread = _vec_len (sm->workers);
1152
1153   return 0;
1154 }
1155
1156
1157 static void
1158 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
1159                                        uword opaque,
1160                                        u32 sw_if_index,
1161                                        ip4_address_t * address,
1162                                        u32 address_length,
1163                                        u32 if_address_index,
1164                                        u32 is_delete);
1165
1166 static clib_error_t * snat_init (vlib_main_t * vm)
1167 {
1168   snat_main_t * sm = &snat_main;
1169   clib_error_t * error = 0;
1170   ip4_main_t * im = &ip4_main;
1171   ip_lookup_main_t * lm = &im->lookup_main;
1172   uword *p;
1173   vlib_thread_registration_t *tr;
1174   vlib_thread_main_t *tm = vlib_get_thread_main ();
1175   uword *bitmap = 0;
1176   u32 i;
1177   ip4_add_del_interface_address_callback_t cb4;
1178
1179   sm->vlib_main = vm;
1180   sm->vnet_main = vnet_get_main();
1181   sm->ip4_main = im;
1182   sm->ip4_lookup_main = lm;
1183   sm->api_main = &api_main;
1184   sm->first_worker_index = 0;
1185   sm->next_worker = 0;
1186   sm->num_workers = 0;
1187   sm->num_snat_thread = 1;
1188   sm->workers = 0;
1189   sm->port_per_thread = 0xffff - 1024;
1190   sm->fq_in2out_index = ~0;
1191   sm->fq_out2in_index = ~0;
1192   sm->udp_timeout = SNAT_UDP_TIMEOUT;
1193   sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
1194   sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
1195   sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
1196
1197   p = hash_get_mem (tm->thread_registrations_by_name, "workers");
1198   if (p)
1199     {
1200       tr = (vlib_thread_registration_t *) p[0];
1201       if (tr)
1202         {
1203           sm->num_workers = tr->count;
1204           sm->first_worker_index = tr->first_index;
1205         }
1206     }
1207
1208   vec_validate (sm->per_thread_data, tm->n_vlib_mains - 1);
1209
1210   /* Use all available workers by default */
1211   if (sm->num_workers > 1)
1212     {
1213       for (i=0; i < sm->num_workers; i++)
1214         bitmap = clib_bitmap_set (bitmap, i, 1);
1215       snat_set_workers(bitmap);
1216       clib_bitmap_free (bitmap);
1217     }
1218   else
1219     {
1220       sm->per_thread_data[0].snat_thread_index = 0;
1221     }
1222
1223   error = snat_api_init(vm, sm);
1224   if (error)
1225     return error;
1226
1227   /* Set up the interface address add/del callback */
1228   cb4.function = snat_ip4_add_del_interface_address_cb;
1229   cb4.function_opaque = 0;
1230
1231   vec_add1 (im->add_del_interface_address_callbacks, cb4);
1232
1233   /* Init IPFIX logging */
1234   snat_ipfix_logging_init(vm);
1235
1236   error = nat64_init(vm);
1237
1238   return error;
1239 }
1240
1241 VLIB_INIT_FUNCTION (snat_init);
1242
1243 void snat_free_outside_address_and_port (snat_main_t * sm,
1244                                          snat_session_key_t * k,
1245                                          u32 address_index)
1246 {
1247   snat_address_t *a;
1248   u16 port_host_byte_order = clib_net_to_host_u16 (k->port);
1249
1250   ASSERT (address_index < vec_len (sm->addresses));
1251
1252   a = sm->addresses + address_index;
1253
1254   switch (k->protocol)
1255     {
1256 #define _(N, i, n, s) \
1257     case SNAT_PROTOCOL_##N: \
1258       ASSERT (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, \
1259         port_host_byte_order) == 1); \
1260       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, \
1261         port_host_byte_order, 0); \
1262       a->busy_##n##_ports--; \
1263       break;
1264       foreach_snat_protocol
1265 #undef _
1266     default:
1267       clib_warning("unknown_protocol");
1268       return;
1269     }
1270 }
1271
1272 /**
1273  * @brief Match NAT44 static mapping.
1274  *
1275  * @param sm          NAT main.
1276  * @param match       Address and port to match.
1277  * @param mapping     External or local address and port of the matched mapping.
1278  * @param by_external If 0 match by local address otherwise match by external
1279  *                    address.
1280  * @param is_addr_only If matched mapping is address only
1281  *
1282  * @returns 0 if match found otherwise 1.
1283  */
1284 int snat_static_mapping_match (snat_main_t * sm,
1285                                snat_session_key_t match,
1286                                snat_session_key_t * mapping,
1287                                u8 by_external,
1288                                u8 *is_addr_only)
1289 {
1290   clib_bihash_kv_8_8_t kv, value;
1291   snat_static_mapping_t *m;
1292   snat_session_key_t m_key;
1293   clib_bihash_8_8_t *mapping_hash = &sm->static_mapping_by_local;
1294   u32 rand, lo = 0, hi, mid;
1295
1296   if (by_external)
1297     mapping_hash = &sm->static_mapping_by_external;
1298
1299   m_key.addr = match.addr;
1300   m_key.port = clib_net_to_host_u16 (match.port);
1301   m_key.protocol = match.protocol;
1302   m_key.fib_index = match.fib_index;
1303
1304   kv.key = m_key.as_u64;
1305
1306   if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
1307     {
1308       /* Try address only mapping */
1309       m_key.port = 0;
1310       m_key.protocol = 0;
1311       kv.key = m_key.as_u64;
1312       if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
1313         return 1;
1314     }
1315
1316   m = pool_elt_at_index (sm->static_mappings, value.value);
1317
1318   if (by_external)
1319     {
1320       if (vec_len (m->locals))
1321         {
1322           hi = vec_len (m->locals) - 1;
1323           rand = 1 + (random_u32 (&sm->random_seed) % m->locals[hi].prefix);
1324           while (lo < hi)
1325             {
1326               mid = ((hi - lo) >> 1) + lo;
1327               (rand > m->locals[mid].prefix) ? (lo = mid + 1) : (hi = mid);
1328             }
1329           if (!(m->locals[lo].prefix >= rand))
1330             return 1;
1331           mapping->addr = m->locals[lo].addr;
1332           mapping->port = clib_host_to_net_u16 (m->locals[lo].port);
1333         }
1334       else
1335         {
1336           mapping->addr = m->local_addr;
1337           /* Address only mapping doesn't change port */
1338           mapping->port = m->addr_only ? match.port
1339             : clib_host_to_net_u16 (m->local_port);
1340         }
1341       mapping->fib_index = m->fib_index;
1342       mapping->protocol = m->proto;
1343     }
1344   else
1345     {
1346       mapping->addr = m->external_addr;
1347       /* Address only mapping doesn't change port */
1348       mapping->port = m->addr_only ? match.port
1349         : clib_host_to_net_u16 (m->external_port);
1350       mapping->fib_index = sm->outside_fib_index;
1351     }
1352
1353   if (PREDICT_FALSE(is_addr_only != 0))
1354     *is_addr_only = m->addr_only;
1355
1356   return 0;
1357 }
1358
1359 static_always_inline u16
1360 snat_random_port (snat_main_t * sm, u16 min, u16 max)
1361 {
1362   return min + random_u32 (&sm->random_seed) /
1363     (random_u32_max() / (max - min + 1) + 1);
1364 }
1365
1366 int snat_alloc_outside_address_and_port (snat_main_t * sm,
1367                                          u32 fib_index,
1368                                          u32 thread_index,
1369                                          snat_session_key_t * k,
1370                                          u32 * address_indexp)
1371 {
1372   int i;
1373   snat_address_t *a;
1374   u32 portnum;
1375
1376   for (i = 0; i < vec_len (sm->addresses); i++)
1377     {
1378       a = sm->addresses + i;
1379       if (sm->vrf_mode && a->fib_index != ~0 && a->fib_index != fib_index)
1380         continue;
1381       switch (k->protocol)
1382         {
1383 #define _(N, j, n, s) \
1384         case SNAT_PROTOCOL_##N: \
1385           if (a->busy_##n##_ports < (sm->port_per_thread * sm->num_snat_thread)) \
1386             { \
1387               while (1) \
1388                 { \
1389                   portnum = (sm->port_per_thread * \
1390                     sm->per_thread_data[thread_index].snat_thread_index) + \
1391                     snat_random_port(sm, 0, sm->port_per_thread) + 1024; \
1392                   if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
1393                     continue; \
1394                   clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
1395                   a->busy_##n##_ports++; \
1396                   k->addr = a->addr; \
1397                   k->port = clib_host_to_net_u16(portnum); \
1398                   *address_indexp = i; \
1399                   return 0; \
1400                 } \
1401             } \
1402           break;
1403           foreach_snat_protocol
1404 #undef _
1405         default:
1406           clib_warning("unknown protocol");
1407           return 1;
1408         }
1409
1410     }
1411   /* Totally out of translations to use... */
1412   snat_ipfix_logging_addresses_exhausted(0);
1413   return 1;
1414 }
1415
1416
1417 static clib_error_t *
1418 add_address_command_fn (vlib_main_t * vm,
1419                         unformat_input_t * input,
1420                         vlib_cli_command_t * cmd)
1421 {
1422   unformat_input_t _line_input, *line_input = &_line_input;
1423   snat_main_t * sm = &snat_main;
1424   ip4_address_t start_addr, end_addr, this_addr;
1425   u32 start_host_order, end_host_order;
1426   u32 vrf_id = ~0;
1427   int i, count;
1428   int is_add = 1;
1429   int rv = 0;
1430   clib_error_t *error = 0;
1431
1432   /* Get a line of input. */
1433   if (!unformat_user (input, unformat_line_input, line_input))
1434     return 0;
1435
1436   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1437     {
1438       if (unformat (line_input, "%U - %U",
1439                     unformat_ip4_address, &start_addr,
1440                     unformat_ip4_address, &end_addr))
1441         ;
1442       else if (unformat (line_input, "tenant-vrf %u", &vrf_id))
1443         ;
1444       else if (unformat (line_input, "%U", unformat_ip4_address, &start_addr))
1445         end_addr = start_addr;
1446       else if (unformat (line_input, "del"))
1447         is_add = 0;
1448       else
1449         {
1450           error = clib_error_return (0, "unknown input '%U'",
1451             format_unformat_error, line_input);
1452           goto done;
1453         }
1454      }
1455
1456   if (sm->static_mapping_only)
1457     {
1458       error = clib_error_return (0, "static mapping only mode");
1459       goto done;
1460     }
1461
1462   start_host_order = clib_host_to_net_u32 (start_addr.as_u32);
1463   end_host_order = clib_host_to_net_u32 (end_addr.as_u32);
1464
1465   if (end_host_order < start_host_order)
1466     {
1467       error = clib_error_return (0, "end address less than start address");
1468       goto done;
1469     }
1470
1471   count = (end_host_order - start_host_order) + 1;
1472
1473   if (count > 1024)
1474     clib_warning ("%U - %U, %d addresses...",
1475                   format_ip4_address, &start_addr,
1476                   format_ip4_address, &end_addr,
1477                   count);
1478
1479   this_addr = start_addr;
1480
1481   for (i = 0; i < count; i++)
1482     {
1483       if (is_add)
1484         snat_add_address (sm, &this_addr, vrf_id);
1485       else
1486         rv = snat_del_address (sm, this_addr, 0);
1487
1488       switch (rv)
1489         {
1490         case VNET_API_ERROR_NO_SUCH_ENTRY:
1491           error = clib_error_return (0, "S-NAT address not exist.");
1492           goto done;
1493         case VNET_API_ERROR_UNSPECIFIED:
1494           error = clib_error_return (0, "S-NAT address used in static mapping.");
1495           goto done;
1496         default:
1497           break;
1498         }
1499
1500       increment_v4_address (&this_addr);
1501     }
1502
1503 done:
1504   unformat_free (line_input);
1505
1506   return error;
1507 }
1508
1509 VLIB_CLI_COMMAND (add_address_command, static) = {
1510   .path = "nat44 add address",
1511   .short_help = "nat44 add address <ip4-range-start> [- <ip4-range-end>] "
1512                 "[tenant-vrf <vrf-id>] [del]",
1513   .function = add_address_command_fn,
1514 };
1515
1516 static clib_error_t *
1517 snat_feature_command_fn (vlib_main_t * vm,
1518                           unformat_input_t * input,
1519                           vlib_cli_command_t * cmd)
1520 {
1521   unformat_input_t _line_input, *line_input = &_line_input;
1522   vnet_main_t * vnm = vnet_get_main();
1523   clib_error_t * error = 0;
1524   u32 sw_if_index;
1525   u32 * inside_sw_if_indices = 0;
1526   u32 * outside_sw_if_indices = 0;
1527   u8 is_output_feature = 0;
1528   int is_del = 0;
1529   int i;
1530
1531   sw_if_index = ~0;
1532
1533   /* Get a line of input. */
1534   if (!unformat_user (input, unformat_line_input, line_input))
1535     return 0;
1536
1537   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1538     {
1539       if (unformat (line_input, "in %U", unformat_vnet_sw_interface,
1540                     vnm, &sw_if_index))
1541         vec_add1 (inside_sw_if_indices, sw_if_index);
1542       else if (unformat (line_input, "out %U", unformat_vnet_sw_interface,
1543                          vnm, &sw_if_index))
1544         vec_add1 (outside_sw_if_indices, sw_if_index);
1545       else if (unformat (line_input, "output-feature"))
1546         is_output_feature = 1;
1547       else if (unformat (line_input, "del"))
1548         is_del = 1;
1549       else
1550         {
1551           error = clib_error_return (0, "unknown input '%U'",
1552             format_unformat_error, line_input);
1553           goto done;
1554         }
1555     }
1556
1557   if (vec_len (inside_sw_if_indices))
1558     {
1559       for (i = 0; i < vec_len(inside_sw_if_indices); i++)
1560         {
1561           sw_if_index = inside_sw_if_indices[i];
1562           if (is_output_feature)
1563             {
1564               if (snat_interface_add_del_output_feature (sw_if_index, 1, is_del))
1565                 {
1566                   error = clib_error_return (0, "%s %U failed",
1567                                              is_del ? "del" : "add",
1568                                              format_vnet_sw_interface_name, vnm,
1569                                              vnet_get_sw_interface (vnm,
1570                                                                     sw_if_index));
1571                   goto done;
1572                 }
1573             }
1574           else
1575             {
1576               if (snat_interface_add_del (sw_if_index, 1, is_del))
1577                 {
1578                   error = clib_error_return (0, "%s %U failed",
1579                                              is_del ? "del" : "add",
1580                                              format_vnet_sw_interface_name, vnm,
1581                                              vnet_get_sw_interface (vnm,
1582                                                                     sw_if_index));
1583                   goto done;
1584                 }
1585             }
1586         }
1587     }
1588
1589   if (vec_len (outside_sw_if_indices))
1590     {
1591       for (i = 0; i < vec_len(outside_sw_if_indices); i++)
1592         {
1593           sw_if_index = outside_sw_if_indices[i];
1594           if (is_output_feature)
1595             {
1596               if (snat_interface_add_del_output_feature (sw_if_index, 0, is_del))
1597                 {
1598                   error = clib_error_return (0, "%s %U failed",
1599                                              is_del ? "del" : "add",
1600                                              format_vnet_sw_interface_name, vnm,
1601                                              vnet_get_sw_interface (vnm,
1602                                                                     sw_if_index));
1603                   goto done;
1604                 }
1605             }
1606           else
1607             {
1608               if (snat_interface_add_del (sw_if_index, 0, is_del))
1609                 {
1610                   error = clib_error_return (0, "%s %U failed",
1611                                              is_del ? "del" : "add",
1612                                              format_vnet_sw_interface_name, vnm,
1613                                              vnet_get_sw_interface (vnm,
1614                                                                     sw_if_index));
1615                   goto done;
1616                 }
1617             }
1618         }
1619     }
1620
1621 done:
1622   unformat_free (line_input);
1623   vec_free (inside_sw_if_indices);
1624   vec_free (outside_sw_if_indices);
1625
1626   return error;
1627 }
1628
1629 VLIB_CLI_COMMAND (set_interface_snat_command, static) = {
1630   .path = "set interface nat44",
1631   .function = snat_feature_command_fn,
1632   .short_help = "set interface nat44 in <intfc> out <intfc> [output-feature] "
1633                 "[del]",
1634 };
1635
1636 uword
1637 unformat_snat_protocol (unformat_input_t * input, va_list * args)
1638 {
1639   u32 *r = va_arg (*args, u32 *);
1640
1641   if (0);
1642 #define _(N, i, n, s) else if (unformat (input, s)) *r = SNAT_PROTOCOL_##N;
1643   foreach_snat_protocol
1644 #undef _
1645   else
1646     return 0;
1647   return 1;
1648 }
1649
1650 u8 *
1651 format_snat_protocol (u8 * s, va_list * args)
1652 {
1653   u32 i = va_arg (*args, u32);
1654   u8 *t = 0;
1655
1656   switch (i)
1657     {
1658 #define _(N, j, n, str) case SNAT_PROTOCOL_##N: t = (u8 *) str; break;
1659       foreach_snat_protocol
1660 #undef _
1661     default:
1662       s = format (s, "unknown");
1663       return s;
1664     }
1665   s = format (s, "%s", t);
1666   return s;
1667 }
1668
1669 static clib_error_t *
1670 add_static_mapping_command_fn (vlib_main_t * vm,
1671                                unformat_input_t * input,
1672                                vlib_cli_command_t * cmd)
1673 {
1674   unformat_input_t _line_input, *line_input = &_line_input;
1675   clib_error_t * error = 0;
1676   ip4_address_t l_addr, e_addr;
1677   u32 l_port = 0, e_port = 0, vrf_id = ~0;
1678   int is_add = 1;
1679   int addr_only = 1;
1680   u32 sw_if_index = ~0;
1681   vnet_main_t * vnm = vnet_get_main();
1682   int rv;
1683   snat_protocol_t proto;
1684   u8 proto_set = 0;
1685
1686   /* Get a line of input. */
1687   if (!unformat_user (input, unformat_line_input, line_input))
1688     return 0;
1689
1690   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1691     {
1692       if (unformat (line_input, "local %U %u", unformat_ip4_address, &l_addr,
1693                     &l_port))
1694         addr_only = 0;
1695       else if (unformat (line_input, "local %U", unformat_ip4_address, &l_addr))
1696         ;
1697       else if (unformat (line_input, "external %U %u", unformat_ip4_address,
1698                          &e_addr, &e_port))
1699         addr_only = 0;
1700       else if (unformat (line_input, "external %U", unformat_ip4_address,
1701                          &e_addr))
1702         ;
1703       else if (unformat (line_input, "external %U %u",
1704                          unformat_vnet_sw_interface, vnm, &sw_if_index,
1705                          &e_port))
1706         addr_only = 0;
1707
1708       else if (unformat (line_input, "external %U",
1709                          unformat_vnet_sw_interface, vnm, &sw_if_index))
1710         ;
1711       else if (unformat (line_input, "vrf %u", &vrf_id))
1712         ;
1713       else if (unformat (line_input, "%U", unformat_snat_protocol, &proto))
1714         proto_set = 1;
1715       else if (unformat (line_input, "del"))
1716         is_add = 0;
1717       else
1718         {
1719           error = clib_error_return (0, "unknown input: '%U'",
1720             format_unformat_error, line_input);
1721           goto done;
1722         }
1723     }
1724
1725   if (!addr_only && !proto_set)
1726     {
1727       error = clib_error_return (0, "missing protocol");
1728       goto done;
1729     }
1730
1731   rv = snat_add_static_mapping(l_addr, e_addr, (u16) l_port, (u16) e_port,
1732                                vrf_id, addr_only, sw_if_index, proto, is_add);
1733
1734   switch (rv)
1735     {
1736     case VNET_API_ERROR_INVALID_VALUE:
1737       error = clib_error_return (0, "External port already in use.");
1738       goto done;
1739     case VNET_API_ERROR_NO_SUCH_ENTRY:
1740       if (is_add)
1741         error = clib_error_return (0, "External addres must be allocated.");
1742       else
1743         error = clib_error_return (0, "Mapping not exist.");
1744       goto done;
1745     case VNET_API_ERROR_NO_SUCH_FIB:
1746       error = clib_error_return (0, "No such VRF id.");
1747       goto done;
1748     case VNET_API_ERROR_VALUE_EXIST:
1749       error = clib_error_return (0, "Mapping already exist.");
1750       goto done;
1751     default:
1752       break;
1753     }
1754
1755 done:
1756   unformat_free (line_input);
1757
1758   return error;
1759 }
1760
1761 /*?
1762  * @cliexpar
1763  * @cliexstart{snat add static mapping}
1764  * Static mapping allows hosts on the external network to initiate connection
1765  * to to the local network host.
1766  * To create static mapping between local host address 10.0.0.3 port 6303 and
1767  * external address 4.4.4.4 port 3606 for TCP protocol use:
1768  *  vpp# nat44 add static mapping tcp local 10.0.0.3 6303 external 4.4.4.4 3606
1769  * If not runnig "static mapping only" NAT plugin mode use before:
1770  *  vpp# nat44 add address 4.4.4.4
1771  * To create static mapping between local and external address use:
1772  *  vpp# nat44 add static mapping local 10.0.0.3 external 4.4.4.4
1773  * @cliexend
1774 ?*/
1775 VLIB_CLI_COMMAND (add_static_mapping_command, static) = {
1776   .path = "nat44 add static mapping",
1777   .function = add_static_mapping_command_fn,
1778   .short_help =
1779     "nat44 add static mapping tcp|udp|icmp local <addr> [<port>] external <addr> [<port>] [vrf <table-id>] [del]",
1780 };
1781
1782 static clib_error_t *
1783 add_lb_static_mapping_command_fn (vlib_main_t * vm,
1784                                   unformat_input_t * input,
1785                                   vlib_cli_command_t * cmd)
1786 {
1787   unformat_input_t _line_input, *line_input = &_line_input;
1788   clib_error_t * error = 0;
1789   ip4_address_t l_addr, e_addr;
1790   u32 l_port = 0, e_port = 0, vrf_id = 0, probability = 0;
1791   int is_add = 1;
1792   int rv;
1793   snat_protocol_t proto;
1794   u8 proto_set = 0;
1795   nat44_lb_addr_port_t *locals = 0, local;
1796
1797   /* Get a line of input. */
1798   if (!unformat_user (input, unformat_line_input, line_input))
1799     return 0;
1800
1801   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1802     {
1803       if (unformat (line_input, "local %U:%u probability %u",
1804                     unformat_ip4_address, &l_addr, &l_port, &probability))
1805         {
1806           memset (&local, 0, sizeof (local));
1807           local.addr = l_addr;
1808           local.port = (u16) l_port;
1809           local.probability = (u8) probability;
1810           vec_add1 (locals, local);
1811         }
1812       else if (unformat (line_input, "external %U:%u", unformat_ip4_address,
1813                          &e_addr, &e_port))
1814         ;
1815       else if (unformat (line_input, "vrf %u", &vrf_id))
1816         ;
1817       else if (unformat (line_input, "protocol %U", unformat_snat_protocol,
1818                          &proto))
1819         proto_set = 1;
1820       else if (unformat (line_input, "del"))
1821         is_add = 0;
1822       else
1823         {
1824           error = clib_error_return (0, "unknown input: '%U'",
1825             format_unformat_error, line_input);
1826           goto done;
1827         }
1828     }
1829
1830   if (vec_len (locals) < 2)
1831     {
1832       error = clib_error_return (0, "at least two local must be set");
1833       goto done;
1834     }
1835
1836   if (!proto_set)
1837     {
1838       error = clib_error_return (0, "missing protocol");
1839       goto done;
1840     }
1841
1842   rv = nat44_add_del_lb_static_mapping (e_addr, (u16) e_port, proto, vrf_id,
1843                                         locals, is_add);
1844
1845   switch (rv)
1846     {
1847     case VNET_API_ERROR_INVALID_VALUE:
1848       error = clib_error_return (0, "External port already in use.");
1849       goto done;
1850     case VNET_API_ERROR_NO_SUCH_ENTRY:
1851       if (is_add)
1852         error = clib_error_return (0, "External addres must be allocated.");
1853       else
1854         error = clib_error_return (0, "Mapping not exist.");
1855       goto done;
1856     case VNET_API_ERROR_VALUE_EXIST:
1857       error = clib_error_return (0, "Mapping already exist.");
1858       goto done;
1859     default:
1860       break;
1861     }
1862
1863 done:
1864   unformat_free (line_input);
1865   vec_free (locals);
1866
1867   return error;
1868 }
1869
1870 VLIB_CLI_COMMAND (add_lb_static_mapping_command, static) = {
1871   .path = "nat44 add load-balancing static mapping",
1872   .function = add_lb_static_mapping_command_fn,
1873   .short_help =
1874     "nat44 add load-balancing static mapping protocol tcp|udp external <addr>:<port> local <addr>:<port> probability <n> [vrf <table-id>] [del]",
1875 };
1876
1877 static clib_error_t *
1878 set_workers_command_fn (vlib_main_t * vm,
1879                         unformat_input_t * input,
1880                         vlib_cli_command_t * cmd)
1881 {
1882   unformat_input_t _line_input, *line_input = &_line_input;
1883   uword *bitmap = 0;
1884   int rv = 0;
1885   clib_error_t *error = 0;
1886
1887   /* Get a line of input. */
1888   if (!unformat_user (input, unformat_line_input, line_input))
1889     return 0;
1890
1891   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1892     {
1893       if (unformat (line_input, "%U", unformat_bitmap_list, &bitmap))
1894         ;
1895       else
1896         {
1897           error = clib_error_return (0, "unknown input '%U'",
1898             format_unformat_error, line_input);
1899           goto done;
1900         }
1901      }
1902
1903   if (bitmap == 0)
1904     {
1905       error = clib_error_return (0, "List of workers must be specified.");
1906       goto done;
1907     }
1908
1909   rv = snat_set_workers(bitmap);
1910
1911   clib_bitmap_free (bitmap);
1912
1913   switch (rv)
1914     {
1915     case VNET_API_ERROR_INVALID_WORKER:
1916       error = clib_error_return (0, "Invalid worker(s).");
1917       goto done;
1918     case VNET_API_ERROR_FEATURE_DISABLED:
1919       error = clib_error_return (0,
1920         "Supported only if 2 or more workes available.");
1921       goto done;
1922     default:
1923       break;
1924     }
1925
1926 done:
1927   unformat_free (line_input);
1928
1929   return error;
1930 }
1931
1932 /*?
1933  * @cliexpar
1934  * @cliexstart{set snat workers}
1935  * Set NAT workers if 2 or more workers available, use:
1936  *  vpp# set snat workers 0-2,5
1937  * @cliexend
1938 ?*/
1939 VLIB_CLI_COMMAND (set_workers_command, static) = {
1940   .path = "set nat workers",
1941   .function = set_workers_command_fn,
1942   .short_help =
1943     "set nat workers <workers-list>",
1944 };
1945
1946 static clib_error_t *
1947 snat_ipfix_logging_enable_disable_command_fn (vlib_main_t * vm,
1948                                               unformat_input_t * input,
1949                                               vlib_cli_command_t * cmd)
1950 {
1951   unformat_input_t _line_input, *line_input = &_line_input;
1952   u32 domain_id = 0;
1953   u32 src_port = 0;
1954   u8 enable = 1;
1955   int rv = 0;
1956   clib_error_t *error = 0;
1957
1958   /* Get a line of input. */
1959   if (!unformat_user (input, unformat_line_input, line_input))
1960     return 0;
1961
1962   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1963     {
1964       if (unformat (line_input, "domain %d", &domain_id))
1965         ;
1966       else if (unformat (line_input, "src-port %d", &src_port))
1967         ;
1968       else if (unformat (line_input, "disable"))
1969         enable = 0;
1970       else
1971         {
1972           error = clib_error_return (0, "unknown input '%U'",
1973             format_unformat_error, line_input);
1974           goto done;
1975         }
1976      }
1977
1978   rv = snat_ipfix_logging_enable_disable (enable, domain_id, (u16) src_port);
1979
1980   if (rv)
1981     {
1982       error = clib_error_return (0, "ipfix logging enable failed");
1983       goto done;
1984     }
1985
1986 done:
1987   unformat_free (line_input);
1988
1989   return error;
1990 }
1991
1992 /*?
1993  * @cliexpar
1994  * @cliexstart{snat ipfix logging}
1995  * To enable NAT IPFIX logging use:
1996  *  vpp# nat ipfix logging
1997  * To set IPFIX exporter use:
1998  *  vpp# set ipfix exporter collector 10.10.10.3 src 10.10.10.1
1999  * @cliexend
2000 ?*/
2001 VLIB_CLI_COMMAND (snat_ipfix_logging_enable_disable_command, static) = {
2002   .path = "nat ipfix logging",
2003   .function = snat_ipfix_logging_enable_disable_command_fn,
2004   .short_help = "nat ipfix logging [domain <domain-id>] [src-port <port>] [disable]",
2005 };
2006
2007 static u32
2008 snat_get_worker_in2out_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2009 {
2010   snat_main_t *sm = &snat_main;
2011   snat_user_key_t key0;
2012   clib_bihash_kv_8_8_t kv0, value0;
2013   u32 next_worker_index = 0;
2014
2015   key0.addr = ip0->src_address;
2016   key0.fib_index = rx_fib_index0;
2017
2018   kv0.key = key0.as_u64;
2019
2020   /* Ever heard of of the "user" before? */
2021   if (clib_bihash_search_8_8 (&sm->worker_by_in, &kv0, &value0))
2022     {
2023       /* No, assign next available worker (RR) */
2024       next_worker_index = sm->first_worker_index;
2025       if (vec_len (sm->workers))
2026         {
2027           next_worker_index +=
2028             sm->workers[sm->next_worker++ % _vec_len (sm->workers)];
2029         }
2030
2031       /* add non-traslated packets worker lookup */
2032       kv0.value = next_worker_index;
2033       clib_bihash_add_del_8_8 (&sm->worker_by_in, &kv0, 1);
2034     }
2035   else
2036     next_worker_index = value0.value;
2037
2038   return next_worker_index;
2039 }
2040
2041 static u32
2042 snat_get_worker_out2in_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2043 {
2044   snat_main_t *sm = &snat_main;
2045   snat_worker_key_t key0;
2046   clib_bihash_kv_8_8_t kv0, value0;
2047   udp_header_t * udp0;
2048   u32 next_worker_index = 0;
2049
2050   udp0 = ip4_next_header (ip0);
2051
2052   key0.addr = ip0->dst_address;
2053   key0.port = udp0->dst_port;
2054   key0.fib_index = rx_fib_index0;
2055
2056   if (PREDICT_FALSE(ip0->protocol == IP_PROTOCOL_ICMP))
2057     {
2058       icmp46_header_t * icmp0 = (icmp46_header_t *) udp0;
2059       icmp_echo_header_t *echo0 = (icmp_echo_header_t *)(icmp0+1);
2060       key0.port = echo0->identifier;
2061     }
2062
2063   kv0.key = key0.as_u64;
2064
2065   /* Ever heard of of the "user" before? */
2066   if (clib_bihash_search_8_8 (&sm->worker_by_out, &kv0, &value0))
2067     {
2068       key0.port = 0;
2069       kv0.key = key0.as_u64;
2070
2071       if (clib_bihash_search_8_8 (&sm->worker_by_out, &kv0, &value0))
2072         {
2073           /* No, assign next available worker (RR) */
2074           next_worker_index = sm->first_worker_index;
2075           if (vec_len (sm->workers))
2076             {
2077               next_worker_index +=
2078                 sm->workers[sm->next_worker++ % _vec_len (sm->workers)];
2079             }
2080         }
2081       else
2082         {
2083           /* Static mapping without port */
2084           next_worker_index = value0.value;
2085         }
2086
2087       /* Add to translated packets worker lookup */
2088       key0.port = udp0->dst_port;
2089       kv0.key = key0.as_u64;
2090       kv0.value = next_worker_index;
2091       clib_bihash_add_del_8_8 (&sm->worker_by_out, &kv0, 1);
2092     }
2093   else
2094     next_worker_index = value0.value;
2095
2096   return next_worker_index;
2097 }
2098
2099 static clib_error_t *
2100 snat_config (vlib_main_t * vm, unformat_input_t * input)
2101 {
2102   snat_main_t * sm = &snat_main;
2103   u32 translation_buckets = 1024;
2104   u32 translation_memory_size = 128<<20;
2105   u32 user_buckets = 128;
2106   u32 user_memory_size = 64<<20;
2107   u32 max_translations_per_user = 100;
2108   u32 outside_vrf_id = 0;
2109   u32 inside_vrf_id = 0;
2110   u32 static_mapping_buckets = 1024;
2111   u32 static_mapping_memory_size = 64<<20;
2112   u8 static_mapping_only = 0;
2113   u8 static_mapping_connection_tracking = 0;
2114
2115   sm->deterministic = 0;
2116
2117   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
2118     {
2119       if (unformat (input, "translation hash buckets %d", &translation_buckets))
2120         ;
2121       else if (unformat (input, "translation hash memory %d",
2122                          &translation_memory_size));
2123       else if (unformat (input, "user hash buckets %d", &user_buckets))
2124         ;
2125       else if (unformat (input, "user hash memory %d",
2126                          &user_memory_size))
2127         ;
2128       else if (unformat (input, "max translations per user %d",
2129                          &max_translations_per_user))
2130         ;
2131       else if (unformat (input, "outside VRF id %d",
2132                          &outside_vrf_id))
2133         ;
2134       else if (unformat (input, "inside VRF id %d",
2135                          &inside_vrf_id))
2136         ;
2137       else if (unformat (input, "static mapping only"))
2138         {
2139           static_mapping_only = 1;
2140           if (unformat (input, "connection tracking"))
2141             static_mapping_connection_tracking = 1;
2142         }
2143       else if (unformat (input, "deterministic"))
2144         sm->deterministic = 1;
2145       else
2146         return clib_error_return (0, "unknown input '%U'",
2147                                   format_unformat_error, input);
2148     }
2149
2150   /* for show commands, etc. */
2151   sm->translation_buckets = translation_buckets;
2152   sm->translation_memory_size = translation_memory_size;
2153   sm->user_buckets = user_buckets;
2154   sm->user_memory_size = user_memory_size;
2155   sm->max_translations_per_user = max_translations_per_user;
2156   sm->outside_vrf_id = outside_vrf_id;
2157   sm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2158                                                              outside_vrf_id,
2159                                                              FIB_SOURCE_PLUGIN_HI);
2160   sm->inside_vrf_id = inside_vrf_id;
2161   sm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2162                                                             inside_vrf_id,
2163                                                             FIB_SOURCE_PLUGIN_HI);
2164   sm->static_mapping_only = static_mapping_only;
2165   sm->static_mapping_connection_tracking = static_mapping_connection_tracking;
2166
2167   if (sm->deterministic)
2168     {
2169       sm->in2out_node_index = snat_det_in2out_node.index;
2170       sm->in2out_output_node_index = ~0;
2171       sm->out2in_node_index = snat_det_out2in_node.index;
2172       sm->icmp_match_in2out_cb = icmp_match_in2out_det;
2173       sm->icmp_match_out2in_cb = icmp_match_out2in_det;
2174     }
2175   else
2176     {
2177       sm->worker_in2out_cb = snat_get_worker_in2out_cb;
2178       sm->worker_out2in_cb = snat_get_worker_out2in_cb;
2179       sm->in2out_node_index = snat_in2out_node.index;
2180       sm->in2out_output_node_index = snat_in2out_output_node.index;
2181       sm->out2in_node_index = snat_out2in_node.index;
2182       if (!static_mapping_only ||
2183           (static_mapping_only && static_mapping_connection_tracking))
2184         {
2185           sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
2186           sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
2187
2188           clib_bihash_init_8_8 (&sm->worker_by_in, "worker-by-in", user_buckets,
2189                                 user_memory_size);
2190
2191           clib_bihash_init_8_8 (&sm->worker_by_out, "worker-by-out", user_buckets,
2192                                 user_memory_size);
2193
2194           clib_bihash_init_8_8 (&sm->in2out, "in2out", translation_buckets,
2195                                 translation_memory_size);
2196
2197           clib_bihash_init_8_8 (&sm->out2in, "out2in", translation_buckets,
2198                                 translation_memory_size);
2199
2200           clib_bihash_init_8_8 (&sm->user_hash, "users", user_buckets,
2201                                 user_memory_size);
2202
2203           clib_bihash_init_16_8 (&sm->in2out_ed, "in2out-ed",
2204                                  translation_buckets, translation_memory_size);
2205
2206           clib_bihash_init_16_8 (&sm->out2in_ed, "out2in-ed",
2207                                  translation_buckets, translation_memory_size);
2208         }
2209       else
2210         {
2211           sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
2212           sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
2213         }
2214       clib_bihash_init_8_8 (&sm->static_mapping_by_local,
2215                             "static_mapping_by_local", static_mapping_buckets,
2216                             static_mapping_memory_size);
2217
2218       clib_bihash_init_8_8 (&sm->static_mapping_by_external,
2219                             "static_mapping_by_external", static_mapping_buckets,
2220                             static_mapping_memory_size);
2221     }
2222
2223   return 0;
2224 }
2225
2226 VLIB_CONFIG_FUNCTION (snat_config, "nat");
2227
2228 u8 * format_snat_session_state (u8 * s, va_list * args)
2229 {
2230   u32 i = va_arg (*args, u32);
2231   u8 *t = 0;
2232
2233   switch (i)
2234     {
2235 #define _(v, N, str) case SNAT_SESSION_##N: t = (u8 *) str; break;
2236     foreach_snat_session_state
2237 #undef _
2238     default:
2239       t = format (t, "unknown");
2240     }
2241   s = format (s, "%s", t);
2242   return s;
2243 }
2244
2245 u8 * format_snat_key (u8 * s, va_list * args)
2246 {
2247   snat_session_key_t * key = va_arg (*args, snat_session_key_t *);
2248
2249   s = format (s, "%U proto %U port %d fib %d",
2250               format_ip4_address, &key->addr,
2251               format_snat_protocol, key->protocol,
2252               clib_net_to_host_u16 (key->port), key->fib_index);
2253   return s;
2254 }
2255
2256 u8 * format_snat_session (u8 * s, va_list * args)
2257 {
2258   snat_main_t * sm __attribute__((unused)) = va_arg (*args, snat_main_t *);
2259   snat_session_t * sess = va_arg (*args, snat_session_t *);
2260
2261   if (snat_is_unk_proto_session (sess))
2262     {
2263       s = format (s, "  i2o %U proto %u fib %u\n",
2264                   format_ip4_address, &sess->in2out.addr, sess->in2out.port,
2265                   sess->in2out.fib_index);
2266       s = format (s, "    o2i %U proto %u fib %u\n",
2267                   format_ip4_address, &sess->out2in.addr, sess->out2in.port,
2268                   sess->out2in.fib_index);
2269     }
2270   else
2271     {
2272       s = format (s, "  i2o %U\n", format_snat_key, &sess->in2out);
2273       s = format (s, "    o2i %U\n", format_snat_key, &sess->out2in);
2274     }
2275   if (sess->ext_host_addr.as_u32)
2276       s = format (s, "       external host %U\n",
2277                   format_ip4_address, &sess->ext_host_addr);
2278   s = format (s, "       last heard %.2f\n", sess->last_heard);
2279   s = format (s, "       total pkts %d, total bytes %lld\n",
2280               sess->total_pkts, sess->total_bytes);
2281   if (snat_is_session_static (sess))
2282     s = format (s, "       static translation\n");
2283   else
2284     s = format (s, "       dynamic translation\n");
2285   if (sess->flags & SNAT_SESSION_FLAG_LOAD_BALANCING)
2286     s = format (s, "       load-balancing\n");
2287
2288   return s;
2289 }
2290
2291 u8 * format_snat_user (u8 * s, va_list * args)
2292 {
2293   snat_main_per_thread_data_t * sm = va_arg (*args, snat_main_per_thread_data_t *);
2294   snat_user_t * u = va_arg (*args, snat_user_t *);
2295   int verbose = va_arg (*args, int);
2296   dlist_elt_t * head, * elt;
2297   u32 elt_index, head_index;
2298   u32 session_index;
2299   snat_session_t * sess;
2300
2301   s = format (s, "%U: %d dynamic translations, %d static translations\n",
2302               format_ip4_address, &u->addr, u->nsessions, u->nstaticsessions);
2303
2304   if (verbose == 0)
2305     return s;
2306
2307   if (u->nsessions || u->nstaticsessions)
2308     {
2309       head_index = u->sessions_per_user_list_head_index;
2310       head = pool_elt_at_index (sm->list_pool, head_index);
2311
2312       elt_index = head->next;
2313       elt = pool_elt_at_index (sm->list_pool, elt_index);
2314       session_index = elt->value;
2315
2316       while (session_index != ~0)
2317         {
2318           sess = pool_elt_at_index (sm->sessions, session_index);
2319
2320           s = format (s, "  %U\n", format_snat_session, sm, sess);
2321
2322           elt_index = elt->next;
2323           elt = pool_elt_at_index (sm->list_pool, elt_index);
2324           session_index = elt->value;
2325         }
2326     }
2327
2328   return s;
2329 }
2330
2331 u8 * format_snat_static_mapping (u8 * s, va_list * args)
2332 {
2333   snat_static_mapping_t *m = va_arg (*args, snat_static_mapping_t *);
2334   nat44_lb_addr_port_t *local;
2335
2336   if (m->addr_only)
2337       s = format (s, "local %U external %U vrf %d",
2338                   format_ip4_address, &m->local_addr,
2339                   format_ip4_address, &m->external_addr,
2340                   m->vrf_id);
2341   else
2342    {
2343       if (vec_len (m->locals))
2344         {
2345           s = format (s, "%U vrf %d external %U:%d",
2346                       format_snat_protocol, m->proto,
2347                       m->vrf_id,
2348                       format_ip4_address, &m->external_addr, m->external_port);
2349           vec_foreach (local, m->locals)
2350             s = format (s, "\n  local %U:%d probability %d\%",
2351                         format_ip4_address, &local->addr, local->port,
2352                         local->probability);
2353         }
2354       else
2355         s = format (s, "%U local %U:%d external %U:%d vrf %d",
2356                     format_snat_protocol, m->proto,
2357                     format_ip4_address, &m->local_addr, m->local_port,
2358                     format_ip4_address, &m->external_addr, m->external_port,
2359                     m->vrf_id);
2360    }
2361   return s;
2362 }
2363
2364 u8 * format_snat_static_map_to_resolve (u8 * s, va_list * args)
2365 {
2366   snat_static_map_resolve_t *m = va_arg (*args, snat_static_map_resolve_t *);
2367   vnet_main_t *vnm = vnet_get_main();
2368
2369   if (m->addr_only)
2370       s = format (s, "local %U external %U vrf %d",
2371                   format_ip4_address, &m->l_addr,
2372                   format_vnet_sw_interface_name, vnm,
2373                   vnet_get_sw_interface (vnm, m->sw_if_index),
2374                   m->vrf_id);
2375   else
2376       s = format (s, "%U local %U:%d external %U:%d vrf %d",
2377                   format_snat_protocol, m->proto,
2378                   format_ip4_address, &m->l_addr, m->l_port,
2379                   format_vnet_sw_interface_name, vnm,
2380                   vnet_get_sw_interface (vnm, m->sw_if_index), m->e_port,
2381                   m->vrf_id);
2382
2383   return s;
2384 }
2385
2386 u8 * format_det_map_ses (u8 * s, va_list * args)
2387 {
2388   snat_det_map_t * det_map = va_arg (*args, snat_det_map_t *);
2389   ip4_address_t in_addr, out_addr;
2390   u32 in_offset, out_offset;
2391   snat_det_session_t * ses = va_arg (*args, snat_det_session_t *);
2392   u32 * i = va_arg (*args, u32 *);
2393
2394   u32 user_index = *i / SNAT_DET_SES_PER_USER;
2395   in_addr.as_u32 = clib_host_to_net_u32 (
2396     clib_net_to_host_u32(det_map->in_addr.as_u32) + user_index);
2397   in_offset = clib_net_to_host_u32(in_addr.as_u32) -
2398     clib_net_to_host_u32(det_map->in_addr.as_u32);
2399   out_offset = in_offset / det_map->sharing_ratio;
2400   out_addr.as_u32 = clib_host_to_net_u32(
2401     clib_net_to_host_u32(det_map->out_addr.as_u32) + out_offset);
2402   s = format (s, "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
2403               format_ip4_address, &in_addr,
2404               clib_net_to_host_u16 (ses->in_port),
2405               format_ip4_address, &out_addr,
2406               clib_net_to_host_u16 (ses->out.out_port),
2407               format_ip4_address, &ses->out.ext_host_addr,
2408               clib_net_to_host_u16 (ses->out.ext_host_port),
2409               format_snat_session_state, ses->state,
2410               ses->expire);
2411
2412   return s;
2413 }
2414
2415 static clib_error_t *
2416 show_snat_command_fn (vlib_main_t * vm,
2417                  unformat_input_t * input,
2418                  vlib_cli_command_t * cmd)
2419 {
2420   int verbose = 0;
2421   snat_main_t * sm = &snat_main;
2422   snat_user_t * u;
2423   snat_static_mapping_t *m;
2424   snat_interface_t *i;
2425   snat_address_t * ap;
2426   vnet_main_t *vnm = vnet_get_main();
2427   snat_main_per_thread_data_t *tsm;
2428   u32 users_num = 0, sessions_num = 0, *worker, *sw_if_index;
2429   uword j = 0;
2430   snat_static_map_resolve_t *rp;
2431   snat_det_map_t * dm;
2432   snat_det_session_t * ses;
2433
2434   if (unformat (input, "detail"))
2435     verbose = 1;
2436   else if (unformat (input, "verbose"))
2437     verbose = 2;
2438
2439   if (sm->static_mapping_only)
2440     {
2441       if (sm->static_mapping_connection_tracking)
2442         vlib_cli_output (vm, "NAT plugin mode: static mapping only connection "
2443                          "tracking");
2444       else
2445         vlib_cli_output (vm, "NAT plugin mode: static mapping only");
2446     }
2447   else if (sm->deterministic)
2448     {
2449       vlib_cli_output (vm, "NAT plugin mode: deterministic mapping");
2450     }
2451   else
2452     {
2453       vlib_cli_output (vm, "NAT plugin mode: dynamic translations enabled");
2454     }
2455
2456   if (verbose > 0)
2457     {
2458       pool_foreach (i, sm->interfaces,
2459       ({
2460         vlib_cli_output (vm, "%U %s", format_vnet_sw_interface_name, vnm,
2461                          vnet_get_sw_interface (vnm, i->sw_if_index),
2462                          i->is_inside ? "in" : "out");
2463       }));
2464
2465       pool_foreach (i, sm->output_feature_interfaces,
2466       ({
2467         vlib_cli_output (vm, "%U output-feature %s",
2468                          format_vnet_sw_interface_name, vnm,
2469                          vnet_get_sw_interface (vnm, i->sw_if_index),
2470                          i->is_inside ? "in" : "out");
2471       }));
2472
2473       if (vec_len (sm->auto_add_sw_if_indices))
2474         {
2475           vlib_cli_output (vm, "NAT44 pool addresses interfaces:");
2476           vec_foreach (sw_if_index, sm->auto_add_sw_if_indices)
2477             {
2478               vlib_cli_output (vm, "%U", format_vnet_sw_interface_name, vnm,
2479                                vnet_get_sw_interface (vnm, *sw_if_index));
2480             }
2481         }
2482
2483       vec_foreach (ap, sm->addresses)
2484         {
2485           vlib_cli_output (vm, "%U", format_ip4_address, &ap->addr);
2486           if (ap->fib_index != ~0)
2487               vlib_cli_output (vm, "  tenant VRF: %u",
2488                                ip4_fib_get(ap->fib_index)->table_id);
2489           else
2490             vlib_cli_output (vm, "  tenant VRF independent");
2491 #define _(N, i, n, s) \
2492           vlib_cli_output (vm, "  %d busy %s ports", ap->busy_##n##_ports, s);
2493           foreach_snat_protocol
2494 #undef _
2495         }
2496     }
2497
2498   if (sm->num_workers > 1)
2499     {
2500       vlib_cli_output (vm, "%d workers", vec_len (sm->workers));
2501       if (verbose > 0)
2502         {
2503           vec_foreach (worker, sm->workers)
2504             {
2505               vlib_worker_thread_t *w =
2506                 vlib_worker_threads + *worker + sm->first_worker_index;
2507               vlib_cli_output (vm, "  %s", w->name);
2508             }
2509         }
2510     }
2511
2512   if (sm->deterministic)
2513     {
2514       vlib_cli_output (vm, "udp timeout: %dsec", sm->udp_timeout);
2515       vlib_cli_output (vm, "tcp-established timeout: %dsec",
2516                        sm->tcp_established_timeout);
2517       vlib_cli_output (vm, "tcp-transitory timeout: %dsec",
2518                        sm->tcp_transitory_timeout);
2519       vlib_cli_output (vm, "icmp timeout: %dsec", sm->icmp_timeout);
2520       vlib_cli_output (vm, "%d deterministic mappings",
2521                        pool_elts (sm->det_maps));
2522       if (verbose > 0)
2523         {
2524           pool_foreach (dm, sm->det_maps,
2525           ({
2526             vlib_cli_output (vm, "in %U/%d out %U/%d\n",
2527                              format_ip4_address, &dm->in_addr, dm->in_plen,
2528                              format_ip4_address, &dm->out_addr, dm->out_plen);
2529             vlib_cli_output (vm, " outside address sharing ratio: %d\n",
2530                              dm->sharing_ratio);
2531             vlib_cli_output (vm, " number of ports per inside host: %d\n",
2532                              dm->ports_per_host);
2533             vlib_cli_output (vm, " sessions number: %d\n", dm->ses_num);
2534             if (verbose > 1)
2535               {
2536                 vec_foreach_index (j, dm->sessions)
2537                   {
2538                     ses = vec_elt_at_index (dm->sessions, j);
2539                     if (ses->in_port)
2540                       vlib_cli_output (vm, "  %U", format_det_map_ses, dm, ses,
2541                                        &j);
2542                   }
2543               }
2544           }));
2545         }
2546     }
2547   else
2548     {
2549       if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
2550         {
2551           vlib_cli_output (vm, "%d static mappings",
2552                            pool_elts (sm->static_mappings));
2553
2554           if (verbose > 0)
2555             {
2556               pool_foreach (m, sm->static_mappings,
2557               ({
2558                 vlib_cli_output (vm, "%U", format_snat_static_mapping, m);
2559               }));
2560             }
2561         }
2562       else
2563         {
2564           vec_foreach (tsm, sm->per_thread_data)
2565             {
2566               users_num += pool_elts (tsm->users);
2567               sessions_num += pool_elts (tsm->sessions);
2568             }
2569
2570           vlib_cli_output (vm, "%d users, %d outside addresses, %d active sessions,"
2571                            " %d static mappings",
2572                            users_num,
2573                            vec_len (sm->addresses),
2574                            sessions_num,
2575                            pool_elts (sm->static_mappings));
2576
2577           if (verbose > 0)
2578             {
2579               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->in2out,
2580                                verbose - 1);
2581               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->out2in,
2582                                verbose - 1);
2583               vlib_cli_output (vm, "%U", format_bihash_16_8, &sm->in2out_ed,
2584                                verbose - 1);
2585               vlib_cli_output (vm, "%U", format_bihash_16_8, &sm->out2in_ed,
2586                                verbose - 1);
2587               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->worker_by_in,
2588                                verbose - 1);
2589               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->worker_by_out,
2590                                verbose - 1);
2591               vec_foreach_index (j, sm->per_thread_data)
2592                 {
2593                   tsm = vec_elt_at_index (sm->per_thread_data, j);
2594
2595                   if (pool_elts (tsm->users) == 0)
2596                     continue;
2597
2598                   vlib_worker_thread_t *w = vlib_worker_threads + j;
2599                   vlib_cli_output (vm, "Thread %d (%s at lcore %u):", j, w->name,
2600                                    w->lcore_id);
2601                   vlib_cli_output (vm, "  %d list pool elements",
2602                                    pool_elts (tsm->list_pool));
2603
2604                   pool_foreach (u, tsm->users,
2605                   ({
2606                     vlib_cli_output (vm, "  %U", format_snat_user, tsm, u,
2607                                      verbose - 1);
2608                   }));
2609                 }
2610
2611               if (pool_elts (sm->static_mappings))
2612                 {
2613                   vlib_cli_output (vm, "static mappings:");
2614                   pool_foreach (m, sm->static_mappings,
2615                   ({
2616                     vlib_cli_output (vm, "%U", format_snat_static_mapping, m);
2617                   }));
2618                   for (j = 0; j < vec_len (sm->to_resolve); j++)
2619                     {
2620                       rp = sm->to_resolve + j;
2621                       vlib_cli_output (vm, "%U",
2622                                        format_snat_static_map_to_resolve, rp);
2623                     }
2624                 }
2625             }
2626         }
2627     }
2628   return 0;
2629 }
2630
2631 VLIB_CLI_COMMAND (show_snat_command, static) = {
2632     .path = "show nat44",
2633     .short_help = "show nat44",
2634     .function = show_snat_command_fn,
2635 };
2636
2637
2638 static void
2639 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
2640                                        uword opaque,
2641                                        u32 sw_if_index,
2642                                        ip4_address_t * address,
2643                                        u32 address_length,
2644                                        u32 if_address_index,
2645                                        u32 is_delete)
2646 {
2647   snat_main_t *sm = &snat_main;
2648   snat_static_map_resolve_t *rp;
2649   u32 *indices_to_delete = 0;
2650   int i, j;
2651   int rv;
2652
2653   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
2654     {
2655       if (sw_if_index == sm->auto_add_sw_if_indices[i])
2656         {
2657           if (!is_delete)
2658             {
2659               /* Don't trip over lease renewal, static config */
2660               for (j = 0; j < vec_len(sm->addresses); j++)
2661                 if (sm->addresses[j].addr.as_u32 == address->as_u32)
2662                   return;
2663
2664               snat_add_address (sm, address, ~0);
2665               /* Scan static map resolution vector */
2666               for (j = 0; j < vec_len (sm->to_resolve); j++)
2667                 {
2668                   rp = sm->to_resolve + j;
2669                   /* On this interface? */
2670                   if (rp->sw_if_index == sw_if_index)
2671                     {
2672                       /* Add the static mapping */
2673                       rv = snat_add_static_mapping (rp->l_addr,
2674                                                     address[0],
2675                                                     rp->l_port,
2676                                                     rp->e_port,
2677                                                     rp->vrf_id,
2678                                                     rp->addr_only,
2679                                                     ~0 /* sw_if_index */,
2680                                                     rp->proto,
2681                                                     rp->is_add);
2682                       if (rv)
2683                         clib_warning ("snat_add_static_mapping returned %d",
2684                                       rv);
2685                       vec_add1 (indices_to_delete, j);
2686                     }
2687                 }
2688               /* If we resolved any of the outstanding static mappings */
2689               if (vec_len(indices_to_delete))
2690                 {
2691                   /* Delete them */
2692                   for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
2693                     vec_delete(sm->to_resolve, 1, j);
2694                   vec_free(indices_to_delete);
2695                 }
2696               return;
2697             }
2698           else
2699             {
2700               (void) snat_del_address(sm, address[0], 1);
2701               return;
2702             }
2703         }
2704     }
2705 }
2706
2707
2708 int snat_add_interface_address (snat_main_t *sm, u32 sw_if_index, int is_del)
2709 {
2710   ip4_main_t * ip4_main = sm->ip4_main;
2711   ip4_address_t * first_int_addr;
2712   snat_static_map_resolve_t *rp;
2713   u32 *indices_to_delete = 0;
2714   int i, j;
2715
2716   first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index,
2717                                                 0 /* just want the address*/);
2718
2719   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
2720     {
2721       if (sm->auto_add_sw_if_indices[i] == sw_if_index)
2722         {
2723           if (is_del)
2724             {
2725               /* if have address remove it */
2726               if (first_int_addr)
2727                   (void) snat_del_address (sm, first_int_addr[0], 1);
2728               else
2729                 {
2730                   for (j = 0; j < vec_len (sm->to_resolve); j++)
2731                     {
2732                       rp = sm->to_resolve + j;
2733                       if (rp->sw_if_index == sw_if_index)
2734                         vec_add1 (indices_to_delete, j);
2735                     }
2736                   if (vec_len(indices_to_delete))
2737                     {
2738                       for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
2739                         vec_del1(sm->to_resolve, j);
2740                       vec_free(indices_to_delete);
2741                     }
2742                 }
2743               vec_del1(sm->auto_add_sw_if_indices, i);
2744             }
2745           else
2746             return VNET_API_ERROR_VALUE_EXIST;
2747
2748           return 0;
2749         }
2750     }
2751
2752   if (is_del)
2753     return VNET_API_ERROR_NO_SUCH_ENTRY;
2754
2755   /* add to the auto-address list */
2756   vec_add1(sm->auto_add_sw_if_indices, sw_if_index);
2757
2758   /* If the address is already bound - or static - add it now */
2759   if (first_int_addr)
2760       snat_add_address (sm, first_int_addr, ~0);
2761
2762   return 0;
2763 }
2764
2765 static clib_error_t *
2766 snat_add_interface_address_command_fn (vlib_main_t * vm,
2767                                        unformat_input_t * input,
2768                                        vlib_cli_command_t * cmd)
2769 {
2770   snat_main_t *sm = &snat_main;
2771   unformat_input_t _line_input, *line_input = &_line_input;
2772   u32 sw_if_index;
2773   int rv;
2774   int is_del = 0;
2775   clib_error_t *error = 0;
2776
2777   /* Get a line of input. */
2778   if (!unformat_user (input, unformat_line_input, line_input))
2779     return 0;
2780
2781   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2782     {
2783       if (unformat (line_input, "%U", unformat_vnet_sw_interface,
2784                     sm->vnet_main, &sw_if_index))
2785         ;
2786       else if (unformat (line_input, "del"))
2787         is_del = 1;
2788       else
2789         {
2790           error = clib_error_return (0, "unknown input '%U'",
2791                                      format_unformat_error, line_input);
2792           goto done;
2793         }
2794     }
2795
2796   rv = snat_add_interface_address (sm, sw_if_index, is_del);
2797
2798   switch (rv)
2799     {
2800     case 0:
2801       break;
2802
2803     default:
2804       error = clib_error_return (0, "snat_add_interface_address returned %d",
2805                                  rv);
2806       goto done;
2807     }
2808
2809 done:
2810   unformat_free (line_input);
2811
2812   return error;
2813 }
2814
2815 VLIB_CLI_COMMAND (snat_add_interface_address_command, static) = {
2816     .path = "nat44 add interface address",
2817     .short_help = "nat44 add interface address <interface> [del]",
2818     .function = snat_add_interface_address_command_fn,
2819 };
2820
2821 static clib_error_t *
2822 snat_det_map_command_fn (vlib_main_t * vm,
2823                          unformat_input_t * input,
2824                          vlib_cli_command_t * cmd)
2825 {
2826   snat_main_t *sm = &snat_main;
2827   unformat_input_t _line_input, *line_input = &_line_input;
2828   ip4_address_t in_addr, out_addr;
2829   u32 in_plen, out_plen;
2830   int is_add = 1, rv;
2831   clib_error_t *error = 0;
2832
2833   /* Get a line of input. */
2834   if (!unformat_user (input, unformat_line_input, line_input))
2835     return 0;
2836
2837   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2838     {
2839       if (unformat (line_input, "in %U/%u", unformat_ip4_address, &in_addr, &in_plen))
2840         ;
2841       else if (unformat (line_input, "out %U/%u", unformat_ip4_address, &out_addr, &out_plen))
2842         ;
2843       else if (unformat (line_input, "del"))
2844         is_add = 0;
2845       else
2846         {
2847           error = clib_error_return (0, "unknown input '%U'",
2848                                      format_unformat_error, line_input);
2849           goto done;
2850         }
2851     }
2852
2853   unformat_free (line_input);
2854
2855   rv = snat_det_add_map(sm, &in_addr, (u8) in_plen, &out_addr, (u8)out_plen,
2856                         is_add);
2857
2858   if (rv)
2859     {
2860       error = clib_error_return (0, "snat_det_add_map return %d", rv);
2861       goto done;
2862     }
2863
2864 done:
2865   unformat_free (line_input);
2866
2867   return error;
2868 }
2869
2870 /*?
2871  * @cliexpar
2872  * @cliexstart{snat deterministic add}
2873  * Create bijective mapping of inside address to outside address and port range
2874  * pairs, with the purpose of enabling deterministic NAT to reduce logging in
2875  * CGN deployments.
2876  * To create deterministic mapping between inside network 10.0.0.0/18 and
2877  * outside network 1.1.1.0/30 use:
2878  * # vpp# nat44 deterministic add in 10.0.0.0/18 out 1.1.1.0/30
2879  * @cliexend
2880 ?*/
2881 VLIB_CLI_COMMAND (snat_det_map_command, static) = {
2882     .path = "nat44 deterministic add",
2883     .short_help = "nat44 deterministic add in <addr>/<plen> out <addr>/<plen> [del]",
2884     .function = snat_det_map_command_fn,
2885 };
2886
2887 static clib_error_t *
2888 snat_det_forward_command_fn (vlib_main_t * vm,
2889                              unformat_input_t * input,
2890                              vlib_cli_command_t * cmd)
2891 {
2892   snat_main_t *sm = &snat_main;
2893   unformat_input_t _line_input, *line_input = &_line_input;
2894   ip4_address_t in_addr, out_addr;
2895   u16 lo_port;
2896   snat_det_map_t * dm;
2897   clib_error_t *error = 0;
2898
2899   /* Get a line of input. */
2900   if (!unformat_user (input, unformat_line_input, line_input))
2901     return 0;
2902
2903   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2904     {
2905       if (unformat (line_input, "%U", unformat_ip4_address, &in_addr))
2906         ;
2907       else
2908         {
2909           error = clib_error_return (0, "unknown input '%U'",
2910                                      format_unformat_error, line_input);
2911           goto done;
2912         }
2913     }
2914
2915   unformat_free (line_input);
2916
2917   dm = snat_det_map_by_user(sm, &in_addr);
2918   if (!dm)
2919     vlib_cli_output (vm, "no match");
2920   else
2921     {
2922       snat_det_forward (dm, &in_addr, &out_addr, &lo_port);
2923       vlib_cli_output (vm, "%U:<%d-%d>", format_ip4_address, &out_addr,
2924                        lo_port, lo_port + dm->ports_per_host - 1);
2925     }
2926
2927 done:
2928   unformat_free (line_input);
2929
2930   return error;
2931 }
2932
2933 /*?
2934  * @cliexpar
2935  * @cliexstart{snat deterministic forward}
2936  * Return outside address and port range from inside address for deterministic
2937  * NAT.
2938  * To obtain outside address and port of inside host use:
2939  *  vpp# nat44 deterministic forward 10.0.0.2
2940  *  1.1.1.0:<1054-1068>
2941  * @cliexend
2942 ?*/
2943 VLIB_CLI_COMMAND (snat_det_forward_command, static) = {
2944     .path = "nat44 deterministic forward",
2945     .short_help = "nat44 deterministic forward <addr>",
2946     .function = snat_det_forward_command_fn,
2947 };
2948
2949 static clib_error_t *
2950 snat_det_reverse_command_fn (vlib_main_t * vm,
2951                              unformat_input_t * input,
2952                              vlib_cli_command_t * cmd)
2953 {
2954   snat_main_t *sm = &snat_main;
2955   unformat_input_t _line_input, *line_input = &_line_input;
2956   ip4_address_t in_addr, out_addr;
2957   u32 out_port;
2958   snat_det_map_t * dm;
2959   clib_error_t *error = 0;
2960
2961   /* Get a line of input. */
2962   if (!unformat_user (input, unformat_line_input, line_input))
2963     return 0;
2964
2965   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2966     {
2967       if (unformat (line_input, "%U:%d", unformat_ip4_address, &out_addr, &out_port))
2968         ;
2969       else
2970         {
2971           error =  clib_error_return (0, "unknown input '%U'",
2972                                       format_unformat_error, line_input);
2973         }
2974     }
2975
2976   unformat_free (line_input);
2977
2978   if (out_port < 1024 || out_port > 65535)
2979     {
2980       error = clib_error_return (0, "wrong port, must be <1024-65535>");
2981       goto done;
2982     }
2983
2984   dm = snat_det_map_by_out(sm, &out_addr);
2985   if (!dm)
2986     vlib_cli_output (vm, "no match");
2987   else
2988     {
2989       snat_det_reverse (dm, &out_addr, (u16) out_port, &in_addr);
2990       vlib_cli_output (vm, "%U", format_ip4_address, &in_addr);
2991     }
2992
2993 done:
2994   unformat_free (line_input);
2995
2996   return error;
2997 }
2998
2999 /*?
3000  * @cliexpar
3001  * @cliexstart{snat deterministic reverse}
3002  * Return inside address from outside address and port for deterministic NAT.
3003  * To obtain inside host address from outside address and port use:
3004  *  #vpp nat44 deterministic reverse 1.1.1.1:1276
3005  *  10.0.16.16
3006  * @cliexend
3007 ?*/
3008 VLIB_CLI_COMMAND (snat_det_reverse_command, static) = {
3009     .path = "nat44 deterministic reverse",
3010     .short_help = "nat44 deterministic reverse <addr>:<port>",
3011     .function = snat_det_reverse_command_fn,
3012 };
3013
3014 static clib_error_t *
3015 set_timeout_command_fn (vlib_main_t * vm,
3016                         unformat_input_t * input,
3017                         vlib_cli_command_t * cmd)
3018 {
3019   snat_main_t *sm = &snat_main;
3020   unformat_input_t _line_input, *line_input = &_line_input;
3021   clib_error_t *error = 0;
3022
3023   /* Get a line of input. */
3024   if (!unformat_user (input, unformat_line_input, line_input))
3025     return 0;
3026
3027   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3028     {
3029       if (unformat (line_input, "udp %u", &sm->udp_timeout))
3030         ;
3031       else if (unformat (line_input, "tcp-established %u",
3032                &sm->tcp_established_timeout))
3033         ;
3034       else if (unformat (line_input, "tcp-transitory %u",
3035                &sm->tcp_transitory_timeout))
3036         ;
3037       else if (unformat (line_input, "icmp %u", &sm->icmp_timeout))
3038         ;
3039       else if (unformat (line_input, "reset"))
3040         {
3041           sm->udp_timeout = SNAT_UDP_TIMEOUT;
3042           sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
3043           sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
3044           sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
3045         }
3046       else
3047         {
3048           error = clib_error_return (0, "unknown input '%U'",
3049                                      format_unformat_error, line_input);
3050           goto done;
3051         }
3052     }
3053
3054   unformat_free (line_input);
3055
3056 done:
3057   unformat_free (line_input);
3058
3059   return error;
3060 }
3061
3062 /*?
3063  * @cliexpar
3064  * @cliexstart{set snat deterministic timeout}
3065  * Set values of timeouts for deterministic NAT (in seconds), use:
3066  *  vpp# set nat44 deterministic timeout udp 120 tcp-established 7500
3067  *  tcp-transitory 250 icmp 90
3068  * To reset default values use:
3069  *  vpp# set nat44 deterministic timeout reset
3070  * @cliexend
3071 ?*/
3072 VLIB_CLI_COMMAND (set_timeout_command, static) = {
3073   .path = "set nat44 deterministic timeout",
3074   .function = set_timeout_command_fn,
3075   .short_help =
3076     "set nat44 deterministic timeout [udp <sec> | tcp-established <sec> "
3077     "tcp-transitory <sec> | icmp <sec> | reset]",
3078 };
3079
3080 static clib_error_t *
3081 snat_det_close_session_out_fn (vlib_main_t *vm,
3082                                unformat_input_t * input,
3083                                vlib_cli_command_t * cmd)
3084 {
3085   snat_main_t *sm = &snat_main;
3086   unformat_input_t _line_input, *line_input = &_line_input;
3087   ip4_address_t out_addr, ext_addr, in_addr;
3088   u16 out_port, ext_port;
3089   snat_det_map_t * dm;
3090   snat_det_session_t * ses;
3091   snat_det_out_key_t key;
3092   clib_error_t *error = 0;
3093
3094   /* Get a line of input. */
3095   if (!unformat_user (input, unformat_line_input, line_input))
3096     return 0;
3097
3098   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3099     {
3100       if (unformat (line_input, "%U:%d %U:%d",
3101                     unformat_ip4_address, &out_addr, &out_port,
3102                     unformat_ip4_address, &ext_addr, &ext_port))
3103         ;
3104       else
3105         {
3106           error = clib_error_return (0, "unknown input '%U'",
3107                                      format_unformat_error, line_input);
3108           goto done;
3109         }
3110     }
3111
3112   unformat_free (line_input);
3113
3114   dm = snat_det_map_by_out(sm, &out_addr);
3115   if (!dm)
3116     vlib_cli_output (vm, "no match");
3117   else
3118     {
3119       snat_det_reverse(dm, &ext_addr, out_port, &in_addr);
3120       key.ext_host_addr = out_addr;
3121       key.ext_host_port = ntohs(ext_port);
3122       key.out_port = ntohs(out_port);
3123       ses = snat_det_get_ses_by_out(dm, &out_addr, key.as_u64);
3124       if (!ses)
3125         vlib_cli_output (vm, "no match");
3126       else
3127        snat_det_ses_close(dm, ses);
3128     }
3129
3130 done:
3131   unformat_free (line_input);
3132
3133   return error;
3134 }
3135
3136 /*?
3137  * @cliexpar
3138  * @cliexstart{snat deterministic close session out}
3139  * Close session using outside ip address and port
3140  * and external ip address and port, use:
3141  *  vpp# nat44 deterministic close session out 1.1.1.1:1276 2.2.2.2:2387
3142  * @cliexend
3143 ?*/
3144 VLIB_CLI_COMMAND (snat_det_close_sesion_out_command, static) = {
3145   .path = "nat44 deterministic close session out",
3146   .short_help = "nat44 deterministic close session out "
3147                 "<out_addr>:<out_port> <ext_addr>:<ext_port>",
3148   .function = snat_det_close_session_out_fn,
3149 };
3150
3151 static clib_error_t *
3152 snat_det_close_session_in_fn (vlib_main_t *vm,
3153                               unformat_input_t * input,
3154                               vlib_cli_command_t * cmd)
3155 {
3156   snat_main_t *sm = &snat_main;
3157   unformat_input_t _line_input, *line_input = &_line_input;
3158   ip4_address_t in_addr, ext_addr;
3159   u16 in_port, ext_port;
3160   snat_det_map_t * dm;
3161   snat_det_session_t * ses;
3162   snat_det_out_key_t key;
3163   clib_error_t *error = 0;
3164
3165   /* Get a line of input. */
3166   if (!unformat_user (input, unformat_line_input, line_input))
3167     return 0;
3168
3169   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3170     {
3171       if (unformat (line_input, "%U:%d %U:%d",
3172                     unformat_ip4_address, &in_addr, &in_port,
3173                     unformat_ip4_address, &ext_addr, &ext_port))
3174         ;
3175       else
3176         {
3177           error = clib_error_return (0, "unknown input '%U'",
3178                                      format_unformat_error, line_input);
3179           goto done;
3180         }
3181     }
3182
3183   unformat_free (line_input);
3184
3185   dm = snat_det_map_by_user (sm, &in_addr);
3186   if (!dm)
3187     vlib_cli_output (vm, "no match");
3188   else
3189     {
3190       key.ext_host_addr = ext_addr;
3191       key.ext_host_port = ntohs (ext_port);
3192       ses = snat_det_find_ses_by_in (dm, &in_addr, ntohs(in_port), key);
3193       if (!ses)
3194         vlib_cli_output (vm, "no match");
3195       else
3196         snat_det_ses_close(dm, ses);
3197     }
3198
3199 done:
3200   unformat_free(line_input);
3201
3202   return error;
3203 }
3204
3205 /*?
3206  * @cliexpar
3207  * @cliexstart{snat deterministic close_session_in}
3208  * Close session using inside ip address and port
3209  * and external ip address and port, use:
3210  *  vpp# nat44 deterministic close session in 3.3.3.3:3487 2.2.2.2:2387
3211  * @cliexend
3212 ?*/
3213 VLIB_CLI_COMMAND (snat_det_close_session_in_command, static) = {
3214   .path = "nat44 deterministic close session in",
3215   .short_help = "nat44 deterministic close session in "
3216                 "<in_addr>:<in_port> <ext_addr>:<ext_port>",
3217   .function = snat_det_close_session_in_fn,
3218 };